← back to popular plugins
wordfence / plugin · change-wp-admin-login
All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more.
change-wp-admin-login
total installs
60,000
total vulns
1
critical
0
high
0
medium
1
low
0
latest vuln
—
patched
1
unpatched
0
avg time to patch
—
vulnerabilities
(1)
WordPress All In One Login Plugin <= 2.0.8 - IP Sooofing to Protection Mechanism Bypass
medium
✓ patched
cve id
CVE-2025-58595 ↗
cvss score
5.3
cwe
CWE-693: Protection Mechanism Failure
published
Oct 9, 2025
The All In One Login — WP Admin Login Page Security and Customization with Google reCAPTCHA, Social Login, Limit Login Attempt, 2FA, and more. plugin for WordPress is vulnerable to IP Address Spoofing in version 2.0.8 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass login protection.