PT-2026-1584 · WordPress · User Activity Log

Angus Girvan · CVE-2025-11877 · Publicado 2026-01-07 · Atualizado 2026-02-02

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions User Activity Log plugin versions prior to and including 2.2

Description The User Activity Log plugin has an issue where the failed-login handler ual shook wp login failed does not perform a capability check. This allows unauthenticated attackers to modify site options using update option() calls. Specifically, attackers can change options from 0 to a non-zero value, potentially reopening registration or corrupting options like wp user roles, which can disrupt access to the wp-admin interface.

Recommendations Update the User Activity Log plugin to a version newer than 2.2.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-11877

Produtos afetados

User Activity Log

Referências · 7

• https://twitter.com/DavidMarquet19/status/2018233146538414344 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/user-activity-log/trunk/user-functions.php · Nota
• https://twitter.com/CVEnew/status/2008824755239956951 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-11877 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/24225f47-cec2-4270-88f0-8696ebfb7168?source=cve · Nota
• https://twitter.com/cracbot/status/2010668119417831817 · Publicação no Twitter
• https://twitter.com/hyunchiya/status/2009550058069582239 · Publicação no Twitter