Security notice
WordPress site using All In One Login? A flaw rated 9.8 can let anyone take over an account, including admins. Update to 2.5.0.
A login security plugin can become the way into your site. All In One Login for WordPress has a critical flaw, CVE-2026-19256, rated 9.8 by WPScan, Patchstack and Tenable. In versions before 2.5.0, someone with no login can take over an account, including an administrator, by guessing a passwordless email login code. Update to 2.5.0 or later today, then audit administrator accounts and login activity. The fix was released on October 26, 2026. Attacks using this flaw are not confirmed in the wild; Patchstack marks it high priority.
What happened
- The flaw. The plugin's passwordless Email OTP login uses a short numeric one-time code. Versions before 2.5.0 do not adequately limit attempts to try that code, and failed tries are not fed into the plugin's own brute-force protection. An attacker with no login can take over any account, including administrators. (WPScan, Patchstack)
- How serious. WPScan, Patchstack and Tenable rate CVE-2026-19256 critical, 9.8 out of 10 under CVSS v3. (WPScan, Patchstack, Tenable)
- Affected versions. Versions before 2.5.0. WPScan specifically highlights 2.4.0 and 2.4.1. Do not stop at 2.4.1: although its August 18 changelog claimed an Email OTP account takeover fix for 2.4.0, WPScan still lists 2.4.1 as affected. Treat 2.5.0 as the fix for this notice. (WPScan, Patchstack, WordPress.org)
- The fix. Version 2.5.0, released October 26, 2026, lists: "Security Fix: Fixed an unauthenticated account takeover vulnerability related to Email OTP login". WordPress.org lists 2.5.1, released October 30, with further hardening. Update to 2.5.0 or later; 2.5.1 is fine. (WordPress.org)
- Attacks are not confirmed. Patchstack marks this high priority and warns that vulnerabilities like this are expected to become exploited in mass-exploit campaigns. That is a warning about risk, not confirmation that attacks on this flaw are happening. (Patchstack)
- CISA's list. CVE-2026-19256 is not listed in the CISA Known Exploited Vulnerabilities Catalog data we could check through November 5, 2026. That is not a reason to delay the update. (CISA KEV)
- Research and disclosure. WPScan credits Jakub Herman. Its timeline puts public publication around November 2, 2026; Patchstack and Tenable published their entries November 5. (WPScan, Patchstack, Tenable)
Who should worry
WordPress site owners and agencies using All In One Login, by Saad Iqbal / WPExperts. Its WordPress.org slug is change-wp-admin-login. It provides login security and customization, including passwordless Email OTP, and WordPress.org shows 60,000+ active installations. (WordPress.org)
- Your site has this plugin on a version before 2.5.0, or you do not know its version.
- You updated to 2.4.1 and assumed the earlier Email OTP fix was enough. WPScan still highlights that version as affected.
- You manage client WordPress sites. Check each site's plugin version individually.
If your site does not use this plugin, this notice does not apply to it.
What to do now
Do these today.
- Check the plugin and version. Ask your developer or look in your WordPress plugins list for All In One Login (
change-wp-admin-login). - Update to 2.5.0 or later. Version 2.5.1 is listed on WordPress.org and includes further hardening. Confirm the installed version afterwards. (WordPress.org)
- Audit administrator accounts. Look for unexpected administrator users. Ask your developer or agency to investigate anything you do not recognize.
- Review login activity logs. Look for unexpected logins. Updating the plugin is not a substitute for reviewing accounts and activity.
What to send your developer, agency or host
Please check every WordPress site we manage for All In One Login (slug change-wp-admin-login). CVE-2026-19256, rated 9.8, allows account takeover without a login through inadequate attempt limits on passwordless Email OTP. Versions before 2.5.0 are affected; WPScan specifically highlights 2.4.0 and 2.4.1. Please update to 2.5.0 or later (2.5.1 is fine), confirm the version, and audit administrator accounts and login activity for unexpected users or logins. Attacks are not confirmed in the wild, but Patchstack marks it high priority. Sources: WordPress.org, WPScan, Patchstack, Tenable.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It means a critical account takeover flaw has a fix. Attacks using this flaw are not confirmed in the wild. Update and review your administrator accounts and login activity.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe from this flaw.
I updated to 2.4.1. Is that enough?
No. WPScan highlights both 2.4.0 and 2.4.1 as affected. Update to 2.5.0 or later, even though the earlier 2.4.1 changelog claimed an Email OTP account takeover fix. (WPScan, WordPress.org)
Is it on CISA's list?
No listing was found in the catalog data we could check through November 5, 2026. Absence from that list is not a safety guarantee. (CISA KEV)
Where can I follow updates?
Use the WordPress.org changelog and the WPScan, Patchstack and Tenable advisories. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- WordPress.org: All In One Login plugin and changelog; 2.5.0 (October 26) and 2.5.1 (October 30, 2026).
- WPScan: CVE-2026-19256 advisory; researcher Jakub Herman; affected versions include 2.4.0 and 2.4.1.
- Patchstack: CVE-2026-19256 advisory, published November 5, 2026; high priority.
- Tenable: CVE-2026-19256 entry, published November 5, 2026; CVSS v3 9.8.
- CISA KEV: Catalog data checked through November 5, 2026; no listing found for CVE-2026-19256.