{
 "id": "WPSEC-2026-2979",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2979/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2979/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2979/index.md",
 "title": "All In One Login <= 2.5.1 - Authenticated (Administrator+) Missing Authorization to Network-Wide Login Log Disclosure via Network REST Endpoints",
 "description": "The All In One Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing network-level capability check on its multisite network REST endpoints (aio-login/network/logs, /counts, /sites and /overview) in versions 2.5.0 up to, and including, 2.5.1. These routes used the generic plugin permission check (manage_options) instead of manage_network_options. On WordPress Multisite installations, this makes it possible for authenticated attackers with site-level Administrator access, but not Super Admin access, to read the login activity logs (usernames, IP addresses, locations and user agents), activity counts and site list of every site in the network.",
 "plugin": {
  "slug": "change-wp-admin-login",
  "name": "All In One Login",
  "full_name": "All In One Login",
  "wordpress_org": "https://wordpress.org/plugins/change-wp-admin-login/",
  "advisories_url": "https://wpsec.com/vuln/plugin/change-wp-admin-login/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/change-wp-admin-login"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.5.0",
    "from_inclusive": true,
    "to": "2.5.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.5.0 before 2.5.2"
  ]
 },
 "introduced_in": "2.5.0",
 "fixed_in": "2.5.2",
 "remediation": "Update to 2.5.2 or later.",
 "fix_released": "2026-11-11T07:13:49+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:42.211090+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2979/",
  "https://plugins.svn.wordpress.org/change-wp-admin-login/tags/2.5.2/",
  "https://wordpress.org/plugins/change-wp-admin-login/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/change-wp-admin-login",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-12"
 }
}