Vulnerability · Published Jan 7, 2026 · Assigned by Wordfence
CVE-2025-11877User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login
High 7.5
In plain English
A high-severity missing authorization in User Activity Log from solwininfotech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| solwininfotech | User Activity Log | 0 – through 2.2 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N