All In One WP Security & Firewall EUVD-2026-89878

Requires an authenticated WordPress account at Subscriber level or higher on a site running All In One WP Security & Firewall version 5.4.8 or earlier (PR:L). Exploitation is limited by high attack complexity (AC:H): the attacker must satisfy conditions outside their direct control - such as specific plugin state, timing, or predictable/spoofable values - rather than firing a single reliable request, so it is not a trivially repeatable bypass. No user interaction is required (UI:N) and no elevated administrative privileges are needed, but self-registration must be enabled (or an account otherwise obtainable) for a remote unauthenticated attacker to reach the Subscriber prerequisite.

This is a genuine but low-severity authentication-bypass-by-spoofing issue (CWE-290) that reads as high-visibility because it affects one of the most-deployed WordPress security plugins, yet the technical signals point to modest real-world risk. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2) shows a network-reachable flaw that nonetheless requires an existing authenticated Subscriber account (PR:L), carries high attack complexity (AC:H - meaning conditions outside the attacker's control must be met, e.g. timing, prediction, or specific state), and yields only limited, partial confidentiality and integrity impact with no availability effect. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no evidence of active or automatable exploitation. The combination of PR:L + AC:H + low impact means this is not a drop-everything priority despite the plugin's huge footprint; it warrants patching in normal cycles. Note a mild tension worth flagging: the product is a 'security & firewall' plugin, so a bypass here undermines a control users rely on, which raises defense-in-depth concern beyond the raw 4.2 score even though the direct data impact is low.

An attacker who already holds a low-privileged Subscriber account on a WordPress site running All In One WP Security & Firewall <= 5.4.8 sends crafted requests that spoof an identity or trust check the plugin performs, bypassing a restriction that should not be reachable at Subscriber level. Because attack complexity is high, success depends on meeting specific conditions rather than a single deterministic request, and the resulting access exposes only limited confidential or modifiable data. No public exploit code is identified at time of analysis.