PT-2026-1584 · WordPress · User Activity Log

Angus Girvan · Published 2026-01-07 · Updated 2026-02-02 · CVE-2025-11877

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions User Activity Log plugin versions prior to and including 2.2

Description The User Activity Log plugin has an issue where the failed-login handler ual shook wp login failed does not perform a capability check. This allows unauthenticated attackers to modify site options using update option() calls. Specifically, attackers can change options from 0 to a non-zero value, potentially reopening registration or corrupting options like wp user roles, which can disrupt access to the wp-admin interface.

Recommendations Update the User Activity Log plugin to a version newer than 2.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11877

Affected Products

User Activity Log

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11877 · Security Note
• https://twitter.com/DavidMarquet19/status/2018233146538414344 · Twitter Post
• https://plugins.trac.wordpress.org/browser/user-activity-log/trunk/user-functions.php · Note
• https://twitter.com/CVEnew/status/2008824755239956951 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/24225f47-cec2-4270-88f0-8696ebfb7168?source=cve · Note
• https://twitter.com/cracbot/status/2010668119417831817 · Twitter Post
• https://twitter.com/hyunchiya/status/2009550058069582239 · Twitter Post