CVE-2025-13471 — User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

CVE-2025-13471

User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update PUBLISHED

Description (CNA)

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)

Affected (CNA)

Vendor / product	Versions
Unknown / User Activity Log	affected 0 through 2.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.