# All In One Login <= 2.5.0 - Authenticated (Subscriber+) Sensitive Information Exposure via 2FA Settings REST Endpoint

- **ID:** WPSEC-2026-2364
- **Plugin:** All In One Login (`change-wp-admin-login`), https://wordpress.org/plugins/change-wp-admin-login/
- **Affected versions:** from 2.5.0 before 2.5.1
- **Fixed in:** 2.5.1 (Update to 2.5.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/change-wp-admin-login
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2364/

## Description

The All In One Login plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'aio-login-pro/tfa/get-settings' REST endpoint in version 2.5.0. This is due to the endpoint's permission callback only checking is_user_logged_in() and the response always including the site-wide 2FA email settings (sender email, admin notification email, email template, OTP expiry, attempt and lockout limits), the site 2FA method and the network feature context. The admin script localized for the 2FA screen also exposed the site admin email. This makes it possible for authenticated attackers with Subscriber-level access and above to read the site administrator's email address and the site-wide 2FA/OTP configuration.

## References

- https://wpsec.com/vuln/WPSEC-2026-2364/
- https://plugins.svn.wordpress.org/change-wp-admin-login/tags/2.5.1/
- https://wordpress.org/plugins/change-wp-admin-login/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2364/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.