{
 "id": "WPSEC-2026-2365",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2365/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2365/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2365/index.md",
 "title": "All In One Login <= 2.5.0 - Authenticated (Administrator+) Missing Authorization to Network Settings Disclosure",
 "description": "The All In One Login plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient permission check on the network settings REST read endpoint in version 2.5.0. The endpoint allowed any user with the manage_options capability, not only network administrators, to read the network settings payload, which includes stored captcha secret keys and the list of sites on the network. This makes it possible for authenticated attackers with site-level Administrator access on a multisite network to read network-level settings that should be restricted to Super Admins.",
 "plugin": {
  "slug": "change-wp-admin-login",
  "name": "All In One Login",
  "full_name": "All In One Login",
  "wordpress_org": "https://wordpress.org/plugins/change-wp-admin-login/",
  "advisories_url": "https://wpsec.com/vuln/plugin/change-wp-admin-login/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/change-wp-admin-login"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-285"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.5.0",
    "from_inclusive": true,
    "to": "2.5.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.5.0 before 2.5.1"
  ]
 },
 "introduced_in": "2.5.0",
 "fixed_in": "2.5.1",
 "remediation": "Update to 2.5.1 or later.",
 "fix_released": "2026-10-30T14:31:19+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:40:39.757455+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2365/",
  "https://plugins.svn.wordpress.org/change-wp-admin-login/tags/2.5.1/",
  "https://wordpress.org/plugins/change-wp-admin-login/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/change-wp-admin-login",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}