All In One Login <= 2.5.0 - Authenticated (Subscriber+) Sensitive Information Exposure via 2FA Settings REST Endpoint
- ID
- WPSEC-2026-2364
- Plugin
- All In One Login (change-wp-admin-login)
- Affected
- from 2.5.0 before 2.5.1
- Remediation
- Update to 2.5.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- All In One Login on WPSec AttackSurface
- Fix released
- Published
Description
The All In One Login plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'aio-login-pro/tfa/get-settings' REST endpoint in version 2.5.0. This is due to the endpoint's permission callback only checking is_user_logged_in() and the response always including the site-wide 2FA email settings (sender email, admin notification email, email template, OTP expiry, attempt and lockout limits), the site 2FA method and the network feature context. The admin script localized for the 2FA screen also exposed the site admin email. This makes it possible for authenticated attackers with Subscriber-level access and above to read the site administrator's email address and the site-wide 2FA/OTP configuration.
References
- https://wpsec.com/vuln/WPSEC-2026-2364/
- https://plugins.svn.wordpress.org/change-wp-admin-login/tags/2.5.1/
- https://wordpress.org/plugins/change-wp-admin-login/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS