CVE-2025-13471

User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

Medium · published January 28, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.3th percentile
Published
2026-01-28T06:00Z
EPSS history
Timeline
  • 28 JAN 06:00Z
    User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update
    cvelistv5