Description (CNA)
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| solwininfotech / User Activity Log | affected 0 through 2.2 |
CWE
CWE-862
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/24225f47-cec2-4270-88f0-8696ebfb7168?source=cve
- https://plugins.trac.wordpress.org/browser/user-activity-log/trunk/user-functions.php
ADP enrichment
No English description supplied.
No references supplied.