CVE-2025-11877 - CVE House

Back to Database

Status published High CVE-2025-11877

User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login

7.5 CVSS

Vulnerability Description

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11877

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Angus Girvan

References

More from solwininfotech

View All →

WordPress Trash Duplicate and 301 Redirect plugin <= 1.9.1 - Broken Access Control vulnerability

WordPress Blog Designer Plugin <= 3.1.8 - Broken Access Control Vulnerability

WordPress WP Social Stream Designer plugin <= 1.3 - SQL Injection vulnerability

Trash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

Timeline Designer <= 1.4 - Authenticated (Admin+) SQL Injection

Affected Vendor

solwininfotech

View all reports →

Affected Software

User Activity Log

Vulnerable Versions:

0

Timeline

Official Publish: January 7th, 2026

Last Modified: April 8th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal