CVE-2025-11877
Unauthorized Options Update in User Activity Log Plugin Allows Site Takeover
Publication date: 2026-01-07
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | user_activity_log | to 2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the User Activity Log plugin versions up to and including 2.2. The failed-login handler 'ual_shook_wp_login_failed' does not perform a capability check and writes failed usernames directly into update_option() calls. This allows unauthenticated attackers to modify certain site options from zero to a non-zero value, which can reopen user registration or corrupt critical options like 'wp_user_roles', potentially breaking access to the WordPress admin area.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to change site options, such as reopening user registration or corrupting the 'wp_user_roles' option. This can lead to unauthorized user registrations or loss of administrative access to the WordPress backend, severely impacting site security and management.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the User Activity Log plugin to a version later than 2.2 where this vulnerability is fixed. Additionally, restrict unauthenticated access to the failed-login handler by implementing capability checks or access controls to prevent unauthorized update_option() calls that could reopen registration or corrupt critical options like 'wp_user_roles'.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you should check if the User Activity Log plugin version is up to and including 2.2, as these versions are vulnerable. Since the vulnerability involves unauthenticated attackers pushing site options via update_option() calls, monitoring for unexpected changes to site options such as 'users_can_register' or 'wp_user_roles' can help detect exploitation attempts. You can query the WordPress options table for suspicious changes. For example, use the following SQL command on your WordPress database to check for recent changes to these options: SELECT option_name, option_value, autoload FROM wp_options WHERE option_name IN ('users_can_register', 'wp_user_roles'); Additionally, monitor your web server logs for POST requests to wp-login.php or admin-ajax.php that include suspicious parameters attempting to update options. You can use commands like: 1. To search web server logs for failed login attempts: grep 'wp-login.php' /var/log/apache2/access.log | grep 'POST' 2. To detect unusual option update requests, you might use a network monitoring tool or a WordPress activity log plugin that logs option updates. Since the plugin logs user activities in the 'wp_ualp_user_activity' table, reviewing entries for unexpected or unauthenticated actions might also help detect exploitation attempts. [2]