Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability in a popular WordPress login plugin allows unauthenticated attackers to gain control of any user account, including administrator accounts, by exploiting a weakness in its passwordless login feature. The issue stems from inadequate restrictions on login attempt failures, which can be leveraged to bypass security measures.
- Unchecked login attempts can seize control of accounts.
- Protects against unauthorized access to user accounts.
- Confirm relevance and verify exposure for login systems.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can take over any account by repeatedly guessing the short numeric code used for passwordless email login. This occurs because the plugin does not limit the number of attempts and does not incorporate these failed attempts into its own brute-force protection. Successful attacks can grant the attacker full control over accounts, including administrative privileges.
- No authentication is required to attempt an attack.
- Attackers can guess the short numeric code repeatedly.
- Risk includes full account takeover, including admin.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, this vulnerability could allow unauthenticated attackers to take over any user account, including administrator accounts, by repeatedly guessing a short numeric code used for passwordless email login. This could affect the confidentiality, integrity, and availability of system data and user accounts.
- User accounts, including administrator accounts.
- Brute-force guessing of a numeric code.
- Account takeover and unauthorized access.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in a WordPress login plugin requires immediate attention from the team managing the WordPress instance, likely application owners or a dedicated web administration team. The first critical step is to identify all instances of the All In One Login plugin, confirm its reachability from the internet, and assess its business criticality. Once ownership is confirmed, a risk-based remediation plan should be developed, potentially involving vendor coordination or temporary mitigation if immediate patching is not feasible.
- WordPress administrators should own this issue.
- Verify plugin reachability and business criticality first.
- Plan and coordinate remediation based on risk.
