WordPress All-In-One Security (AIOS) plugin < 5.5.0 - Subscriber+ 2FA Bypass vulnerability

Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin All In One WP Security & Firewall versions 5.5.0...

CVE-2026-111739 Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...

CVE-2023-0156

CVE ID : CVE-2023-0156 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...

CVE-2026-8438: Improper Neutralization of Input During Web Page Generation

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the getrestroute function and missing output escaping in the columndefault method of the...

CVE-2024-1037: Improper Neutralization of Input During Web Page Generation

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-0157: Improper Neutralization of Input During Web Page Generation

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user admin+ to plant bogus log files containing malicious JavaScript code that will be executed in the context of any...

CVE-2023-0156: Improper Limitation of a Pathname to a Restricted Directory

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

CVE-2022-4346: Undefined Security Weakness

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

CVE-2022-4097: Authorization Bypass Through User-Controlled Key

The All-In-One Security AIOS WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features like IP blocks, rate limiting, brute force protection, and more...

CVE-2022-44737: Cross-Site Request Forgery (CSRF)

Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security AIOS – Security and Firewall WordPress plugin = 5.1.0 on WordPress...

PT-2022-27291

Name of the Vulnerable Software and Affected Versions All-In-One Security AIOS – Security and Firewall WordPress plugin versions = 5.1.0 Description The issue concerns Multiple Cross-Site Request Forgery vulnerabilities. These vulnerabilities are present in the All-In-One Security AIOS – Security...