All-In-One Security (AIOS), a popular WordPress security plugin, has released version 5.5.0 with important improvements to login protection, two-factor authentication, and firewall logging.
The official WordPress.org changelog lists the release on October 26, 2026. It fixes a security flaw that could allow unauthorized requests to clear login lockouts without the required verification.
If your website uses AIOS, here’s what changed, why it matters, and how to update safely.
AIOS 5.5.0 Update: Summary
| Detail | Information |
|---|---|
| Plugin | All-In-One Security (AIOS) |
| Version | 5.5.0 |
| Release date | October 26, 2026 |
| Main security fix | Unauthorized clearing of login lockouts |
| Protection added | Valid nonce and unlock key required |
| Additional fixes | WooCommerce password-reset and 2FA issues |
| CVE | Not identified in the changelog |
| Active exploitation | Not confirmed by the reviewed sources |
1. What Was the Login Lockout Security Issue?
AIOS uses login lockouts to help protect WordPress websites against repeated password attempts.
In the affected implementation, a request containing an empty aiowps_auth_key parameter could clear a login lockout without the required verification.
This weakened a protection intended to slow unauthorized login attempts.
Version 5.5.0 fixes the issue by requiring a valid nonce and unlock key before a lockout can be cleared.
Security researcher Filip Kowalski responsibly disclosed the flaw.
The official changelog does not assign a CVE to this issue or confirm active exploitation.
2. Additional Security Fixes in AIOS 5.5.0
The release also addresses two-factor authentication problems.
One fix prevents WooCommerce from automatically logging in users with 2FA enabled after a password reset. Previously, access to the password-reset email could potentially allow login without completing the expected 2FA step.
Another fix addresses a request-forgery issue involving lower-privileged users and another account’s 2FA code. Completing the login would still require the target account’s password.
These fixes are separate from the login-lockout issue and strengthen different parts of the authentication process.
3. New Features in Version 5.5.0
AIOS 5.5.0 also introduces practical administration improvements.
- Firewall audit and debug logs: Easier investigation of firewall activity.
- Session mechanism: Better context for related firewall requests.
- Audit log pagination: Choose how many records appear on each page.
- Configurable log retention: Manage how long audit logs are retained.
- Login-page redirect: Redirect unauthorized visitors away from the standard administration page.
- Safer file restoration: Content-hash checks for backed-up
.htaccessandwp-config.phpfiles.
The release also improves database migration handling for large tables and raises the minimum requirements to WordPress 5.3 and PHP 7.4.
AIOS Free vs Premium
| Feature | Free | Premium |
|---|---|---|
| Login attempt limits | Yes | Yes |
| Two-factor authentication | Yes | Enhanced options |
| Firewall and hardening | Yes | Additional protection |
| Malware scanning | Limited/core scanning tools | Weekly malware scanning |
| Uptime monitoring | Limited | Yes |
| Country blocking | Limited | Yes |
| Developer support | Community resources | Direct support |
Premium availability depends on the current TeamUpdraft plan. Check the official product page before purchasing.
How to Update AIOS Safely
Follow these steps to update your website.
- Back up your site. Save your database and WordPress files, with a copy stored offsite.
- Check your current version. Go to Plugins → Installed Plugins and locate All-In-One Security.
- Check compatibility. Ensure your website meets the minimum WordPress and PHP requirements.
- Update AIOS. Open Dashboard → Updates or use the plugin’s update option to install version 5.5.0 or a newer verified release.
- Review login protection. Check lockout settings, 2FA, and WooCommerce password-reset behavior.
- Test your website. Verify administrator login, customer login, password resets, and checkout.
- Review logs. Confirm that audit and firewall logging work as expected.
If you manage a WooCommerce store, perform critical tests on a staging website before updating production.
Frequently Asked Questions
What does AIOS 5.5.0 fix?
It fixes unauthorized login-lockout clearing and addresses additional WooCommerce password-reset and 2FA security issues.
Is AIOS 5.5.0 a security update?
Yes. The official changelog explicitly identifies multiple security fixes.
Is active exploitation confirmed?
The reviewed release notes do not confirm active exploitation or identify a new CVE for the lockout issue.
Is All-In-One Security free?
Yes. AIOS offers a free plugin, with additional security and support features available through Premium.
Final Verdict
The All-In-One Security 5.5.0 update is an important release for WordPress site owners who rely on login lockouts and two-factor authentication.
Updating helps restore the intended security checks and adds useful firewall logging and administration features.
Back up your website, install the latest compatible release, and verify your login and password-reset workflows.
For more WordPress security news, plugin updates, and practical protection guides, visit GPLNESTS.COM.
