CVE-2025-58595

MediumCVSS 5.3

Published: 06/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

An authentication bypass by spoofing vulnerability in the Saad Iqbal All In One Login (change-wp-admin-login) WordPress plugin allows identity spoofing. The issue affects All In One Login from n/a through version 2.0.8.

Risk Assessment

An attacker could bypass authentication mechanisms and impersonate another identity, potentially leading to unauthorized access to the WordPress admin panel. Impact depends on site configuration.

Recommendation

Update the All In One Login plugin to a version later than 2.0.8 or disable it if no fix is available.

Other vulnerabilities in All In One Login

CVE-2026-94175High
The All In One Login WordPress plugin in versions up to 2.4.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability.

Original NVD description (English source)

Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affects All In One Login: from n/a through <= 2.0.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS