CVE-2025-13471

The User Activity Log WordPress plugin through version 2.2 contains a vulnerability in its handling of failed login attempts. The plugin does not properly validate or restrict the actions taken upon a failed login, enabling an unauthenticated attacker to set arbitrary WordPress options to the value 1 [1].

An attacker can exploit this by sending crafted requests that mimic failed login attempts, bypassing the intended access controls. No authentication is required, and the attack can be launched remotely over the network [1].

Successful exploitation allows the attacker to enable settings that were previously disabled. For example, an attacker could turn on user registration when it had been turned off, potentially leading to unauthorized account creation and further compromise [1].

As of the publication date, no fix is available. The vendor has not released a patched version, and the plugin remains vulnerable. Administrators are advised to disable the plugin until a security update is issued [1].