Read the docs
TI-2025-10888 Aliases CVE-2025-11877GHSA-69mj-pc6r-5cgv

User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login

Priority LOW 39CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00364 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
solwininfotechUser Activity Logup to 2.2—No fix listedCNA
  • User Activity Log Vendorsolwininfotech Affected up to 2.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-11877
  2. 2026-10-03 Alias added: GHSA-69mj-pc6r-5cgv

References

Other 2

  • TI-2023-03210 User Activity Log < 1.6.5 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
  • TI-2023-04721 User Activity Log Pro < 2.3.4 - IP Spoofing CVSS 3.1HIGH 7.5
  • TI-2023-03959 User Activity Log < 1.6.7 - IP Spoofing CVSS 3.1HIGH 7.5
  • TI-2023-02585 User Activity Log < 1.6.3 - Admin+ SQL Injection CVSS 3.1HIGH 7.2
  • TI-2022-04389 Blog Designer – Post and Widget < 2.4.1 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 6.8
  • TI-2023-04755 User Activity Log Pro < 2.3.4 - Unauthenticated Stored Cross-Site Scripting via User Agent CVSS 3.1MEDIUM 5.4
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences