CVE-2025-13471 — User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (fo…
Published: 2026-01-28 · CVSS: 5.3 · CVSS 3.1
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7