PT-2025-45243 · Saadiqbal+1 · All In One Login+1
CVE-2025-58595
·
Published
2025-10-09
·
Updated
2025-11-06
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
All In One Login versions prior to 2.0.9
Description
An authentication bypass issue exists due to insufficient IP address validation and the use of user-supplied HTTP headers as the primary method for IP retrieval. This allows unauthenticated attackers to perform IP address spoofing, enabling them to bypass login protection and achieve identity spoofing.
Recommendations
Update to a version newer than 2.0.8.
Fix
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
All In One Login
Change Wp Admin Login