All In One Login <= 2.5.1 - Authenticated (Administrator+) Missing Authorization to Network-Wide Login Log Disclosure via Network REST Endpoints
- ID
- WPSEC-2026-2979
- Plugin
- All In One Login (change-wp-admin-login)
- Affected
- from 2.5.0 before 2.5.2
- Remediation
- Update to 2.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-12
- Attack surface
- All In One Login on WPSec AttackSurface
- Fix released
- Published
Description
The All In One Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing network-level capability check on its multisite network REST endpoints (aio-login/network/logs, /counts, /sites and /overview) in versions 2.5.0 up to, and including, 2.5.1. These routes used the generic plugin permission check (manage_options) instead of manage_network_options. On WordPress Multisite installations, this makes it possible for authenticated attackers with site-level Administrator access, but not Super Admin access, to read the login activity logs (usernames, IP addresses, locations and user agents), activity counts and site list of every site in the network.
References
- https://wpsec.com/vuln/WPSEC-2026-2979/
- https://plugins.svn.wordpress.org/change-wp-admin-login/tags/2.5.2/
- https://wordpress.org/plugins/change-wp-admin-login/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS