WordPress News
All-In-One Security (AIOS) 5.4.10 Released
What’s new in All-In-One Security (AIOS) 5.4.10
Released: 16/Sep/2026
Active installations: 1,000,000
Tested up to WordPress 7.1
Requires PHP 5.6
Changelog
- SECURITY: Login lockout unlock requests allowed users to unlock another account’s lockout because they were validated based only on the IP address, without checking the user account. Thanks to Ananda Dhakal for disclosing this defect. (This would allow an attacker sharing the same IP address as a user with an active lockout to clear that user’s lockout.)
Previous releases
5.4.9 — 5/Jun/2026
- TWEAK: Added a filter that validates POST requests containing UDRPC messages
- TWEAK: Update the internal common libs package to latest version
5.4.8 — 2/Jun/2026
- SECURITY: Escaped debug log messages before rendering them in the admin area to prevent a stored XSS vulnerability. Thanks to Dmitrii Ignatyev for disclosing this defect. (This issue required both the debug logging feature and the “Disallow unauthorized REST API requests” setting to be enabled. Under those conditions, an attacker could inject malicious scripts into the debug logs via specially crafted requests, which could execute when viewed by an administrator on the AIOS debug logs page).
- FEATURE: Add notification method to reporting class to handle mails
- FEATURE: Added bulk actions to audit log table for blacklisting IPs
- FIX: Fixed minor bug when setting up TFA with the Onboarding wizard where correct codes are rejected if they are entered more than once.
- FIX: Log out button/link not working immediately after enabling the rename login feature