What’s Vulnerable › Vulnerabilities

CVE-2025-11877: User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-07 · updated 2026-06-17
• Weakness: CWE-862

Description

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.

Affected products

• User Activity Log: through 2.2

References

• https://plugins.trac.wordpress.org/browser/user-activity-log/trunk/user-functions.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/24225f47-cec2-4270-88f0-8696ebfb7168?source=cve

Get alerted when CVE-2025-11877 or the next vulnerability affects your stack