High · published January 7, 2026
⚡ Unauthenticated attackers could easily tweak your site settings with just a failed login attempt! 🔥 It's like a mischievous prankster slipping a fake order into a restaurant's system, changing the special of the day without anyone noticing — suddenly, everyone’s confused about what’s being served! If an attacker exploits this vulnerability, they could manipulate important site options, potentially reopening user registration or even corrupting key settings like 'wp_user_roles'. This could lock you out of your own admin dashboard, and that’s absolutely devastating for your site’s security!
It's like a mischievous prankster slipping a fake order into a restaurant's system, changing the special of the day without anyone noticing — suddenly, everyone’s confused about what’s being served! This vulnerability in the User Activity Log plugin allows attackers to execute a limited options update without authentication, thanks to a missing capability check in the failed-login handler. This means they can directly write to the site’s options, compromising its integrity.
If an attacker exploits this vulnerability, they could manipulate important site options, potentially reopening user registration or even corrupting key settings like 'wp_user_roles'. This could lock you out of your own admin dashboard, and that’s absolutely devastating for your site’s security! To protect your site, update the User Activity Log plugin to version 2.3 or higher immediately. Additionally, verify your user roles and permissions to ensure everything is secure! You've got this! Fix it up and keep your site safe. 🛡️