CVE-2025-11877

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.

• CWE-862

• https://plugins.trac.wordpress.org/browser/user-activity-log/trunk/user-functions.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/24225f47-cec2-4270-88f0-8696ebfb7168?source=cve

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11870The Simple Business Data plugin for WordPress is vulnerable …6.4
• CVE-2025-11872The Material Design Iconic Font Integration plugin for WordP…6.4
• CVE-2025-11873The WP BBCode plugin for WordPress is vulnerable to Stored C…6.4
• CVE-2025-11874The Slippy Slider – Responsive Touch Navigation Slider plugi…5.4
• CVE-2025-11875The SpendeOnline.org plugin for WordPress is vulnerable to S…6.4
• CVE-2025-11876The Mailgun Subscriptions plugin for WordPress is vulnerable…6.4
• CVE-2025-11878The ST Categories Widget plugin for WordPress is vulnerable …6.4
• CVE-2025-11879The GenerateBlocks plugin for WordPress is vulnerable to una…6.5
• CVE-2025-1188A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-11880The SM CountDown Widget plugin for WordPress is vulnerable t…6.4
• CVE-2025-11881The AppPresser – Mobile App Framework plugin for WordPress i…5.3
• CVE-2025-11882The Simple Donate plugin for WordPress is vulnerable to Stor…6.4