WordPress News
All-In-One Security (AIOS) 5.5.1 Released
What’s new in All-In-One Security (AIOS) 5.5.1
Released: 30/Oct/2026
Active installations: 1,000,000
Tested up to WordPress 7.1.4
Requires PHP 7.4
Changelog
- FIX: Updated Cloudflare Turnstile key check regex to allow underscores and hyphens.
- TWEAK: Removed unused lib-central library.
- TWEAK: Add a Black Friday promo.
Previous releases
5.5.0 — 26/Oct/2026
- SECURITY: Prevented unauthorised clearing of login lockouts via an empty aiowps_auth_key parameter by requiring a valid nonce and unlock key. Thanks to Filip Kowalski for disclosing this defect.
- SECURITY: Do not allow WooCommerce to auto-login a user who has TFA active when they perform a password reset. i.e. On previous versions, if using WooCommerce’s “Lost password” facility, someone with access to the email account to which the password reset link was sent could login without providing a TFA code.
- SECURITY: On a site where users with lower privilege levels (e.g. subscriber) existed, a lower-privileged user could forge a request and thereby have his own TFA code accepted for someone else’s account. To complete login he would also need to know the password of the account he was logging into. Thanks to Karol Czubernat for the responsible disclosure, via WPScan.
- FEATURE: Added an Integration settings tab to connect a TeamUpdraft account, providing the authentication used by features that connect to the TeamUpdraft cloud.
- FEATURE: Added an optional redirect URL to the Rename Login Page feature, so non-logged-in visitors who try to access wp-admin can be sent to a chosen page instead of seeing a “you do not have permission” message.
5.4.10 — 16/Sep/2026
- SECURITY: Login lockout unlock requests allowed users to unlock another account’s lockout because they were validated based only on the IP address, without checking the user account. Thanks to Ananda Dhakal for disclosing this defect. (This would allow an attacker sharing the same IP address as a user with an active lockout to clear that user’s lockout.)