# All In One Login <= 2.5.1 - Authenticated (Administrator+) Missing Authorization to Network-Wide Login Log Disclosure via Network REST Endpoints

- **ID:** WPSEC-2026-2979
- **Plugin:** All In One Login (`change-wp-admin-login`), https://wordpress.org/plugins/change-wp-admin-login/
- **Affected versions:** from 2.5.0 before 2.5.2
- **Fixed in:** 2.5.2 (Update to 2.5.2 or later.)
- **Severity:** Low 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/change-wp-admin-login
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2979/

## Description

The All In One Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing network-level capability check on its multisite network REST endpoints (aio-login/network/logs, /counts, /sites and /overview) in versions 2.5.0 up to, and including, 2.5.1. These routes used the generic plugin permission check (manage_options) instead of manage_network_options. On WordPress Multisite installations, this makes it possible for authenticated attackers with site-level Administrator access, but not Super Admin access, to read the login activity logs (usernames, IP addresses, locations and user agents), activity counts and site list of every site in the network.

## References

- https://wpsec.com/vuln/WPSEC-2026-2979/
- https://plugins.svn.wordpress.org/change-wp-admin-login/tags/2.5.2/
- https://wordpress.org/plugins/change-wp-admin-login/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2979/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.