CVE-2025-13471

User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)

Affected

User Activity Log

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 21st percentile

Published

2026-01-28

Updated

2026-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/

References

• CVE Record
• NVD entry