توضیحات
Protect your WordPress site with All-In-One Security (AIOS): easy-to-use login security, a powerful firewall, and much more.
تغییرات این نسخه
5.5.1 – 30/Oct/2026
FIX: Updated Cloudflare Turnstile key check regex to allow underscores and hyphens.
TWEAK: Removed unused lib-central library.
TWEAK: Add a Black Friday promo.
5.5.0 – 26/Oct/2026
SECURITY: Prevented unauthorised clearing of login lockouts via an empty aiowps_auth_key parameter by requiring a valid nonce and unlock key. Thanks to Filip Kowalski for disclosing this defect.
SECURITY: Do not allow WooCommerce to auto-login a user who has TFA active when they perform a password reset. i.e. On previous versions, if using WooCommerce’s “Lost password” facility, someone with access to the email account to which the password reset link was sent could login without providing a TFA code.
SECURITY: On a site where users with lower privilege levels (e.g. subscriber) existed, a lower-privileged user could forge a request and thereby have his own TFA code accepted for someone else’s account. To complete login he would also need to know the password of the account he was logging into. Thanks to Karol Czubernat for the responsible disclosure, via WPScan.
FEATURE: Added an Integration settings tab to connect a TeamUpdraft account, providing the authentication used by features that connect to the TeamUpdraft cloud.
FEATURE: Added an optional redirect URL to the Rename Login Page feature, so non-logged-in visitors who try to access wp-admin can be sent to a chosen page instead of seeing a “you do not have permission” message.
FEATURE: Added audit and debug logging
FIX: Updated Cloudflare Turnstile key check regex to allow underscores and hyphens.
TWEAK: Removed unused lib-central library.
TWEAK: Add a Black Friday promo.
5.5.0 – 26/Oct/2026
SECURITY: Prevented unauthorised clearing of login lockouts via an empty aiowps_auth_key parameter by requiring a valid nonce and unlock key. Thanks to Filip Kowalski for disclosing this defect.
SECURITY: Do not allow WooCommerce to auto-login a user who has TFA active when they perform a password reset. i.e. On previous versions, if using WooCommerce’s “Lost password” facility, someone with access to the email account to which the password reset link was sent could login without providing a TFA code.
SECURITY: On a site where users with lower privilege levels (e.g. subscriber) existed, a lower-privileged user could forge a request and thereby have his own TFA code accepted for someone else’s account. To complete login he would also need to know the password of the account he was logging into. Thanks to Karol Czubernat for the responsible disclosure, via WPScan.
FEATURE: Added an Integration settings tab to connect a TeamUpdraft account, providing the authentication used by features that connect to the TeamUpdraft cloud.
FEATURE: Added an optional redirect URL to the Rename Login Page feature, so non-logged-in visitors who try to access wp-admin can be sent to a chosen page instead of seeing a “you do not have permission” message.
FEATURE: Added audit and debug logging