CVE-2025-13471

User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

CVSS 5.3 MEDIUMEPSS 0.3%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

28 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Unknown · User Activity Log

References

https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/