WordPress All In One Login Brute Force Bypass

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The All In One Login WordPress plugin before version 2.5.0 contains a critical authentication bypass vulnerability that undermines its passwordless email login feature. The plugin fails to implement adequate rate limiting on short numeric codes sent via email, and critically, does not integrate these failed attempts with its brute-force protection mechanism. This allows unauthenticated attackers to conduct unlimited brute-force attacks against the numeric codes, enabling complete account takeover including administrator accounts. The vulnerability affects WordPress installations using this popular plugin with its default passwordless login enabled, creating a direct path to administrative compromise for any site running the vulnerable version.

Casky's 224 mapped security skills leverage Claude AI with extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0004) techniques. Practitioners using Casky would detect this through reconnaissance of failed authentication attempts that bypass rate limiting controls, unusual patterns of numeric code submissions, and account access from previously unseen locations following multiple failed login attempts. The platform's skill set would flag the absence of failed attempt logging in brute-force protection systems, anomalous email login activity spikes, and successful authentications immediately following high-volume code attempt sequences. By mapping these behavioral indicators to TA0004 Initial Access techniques, practitioners gain visibility into exploitation attempts before successful compromise, enabling proactive account lockdown and plugin remediation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19256.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-19256

Casky has 224 skills that investigate the attack patterns behind CVE-2026-19256. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn