Threats tagged 'ghsa-j2j9-q63m-9wvj'

The All In One Login WordPress plugin versions before 2.5.0 have a vulnerability where the plugin does not properly limit the number of attempts against the short numeric code used in its default passwordless email login feature. Additionally, failed attempts are not counted towards the plugin's brute-force protection, enabling unauthenticated attackers to potentially take over any user account, including administrator accounts.