User Activity Log, CVE-2025-11877

CVE, Research URL: CVE-2025-11877
Home page URL: Security reports for User Activity Log
Application: User Activity Log
Published on: Jan 07, 2026
Research Description: The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access.
Affected versions: max 2.2.
Status: vulnerable