All In One Loginの乗っ取り脆弱性、2.5.0で修正
Summary
WordPressプラグインAll In One Loginに、ログインなしで管理者を含む任意のアカウントを乗っ取られる脆弱性があります。2.4.0以降の版を使うサイトは、2.5.0への更新を急いでください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressプラグインAll In One Loginに、ログインなしで管理者を含む任意のアカウントを乗っ取られる脆弱性があります。2.4.0以降の版を使うサイトは、2.5.0への更新を急いでください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| CVE | All In One Login |
≥ 2.4.0, < 2.5.0 |
2.5.0 |
Original description The description as published by the source.
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com