Executive Summary

The vulnerability exists in the User Activity Log plugin versions up to and including 2.2. The failed-login handler 'ual_shook_wp_login_failed' does not perform a capability check and writes failed usernames directly into update_option() calls. This allows unauthenticated attackers to modify certain site options from zero to a non-zero value, which can reopen user registration or corrupt critical options like 'wp_user_roles', potentially breaking access to the WordPress admin area.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to change site options, such as reopening user registration or corrupting the 'wp_user_roles' option. This can lead to unauthorized user registrations or loss of administrative access to the WordPress backend, severely impacting site security and management.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the User Activity Log plugin to a version later than 2.2 where this vulnerability is fixed. Additionally, restrict unauthenticated access to the failed-login handler by implementing capability checks or access controls to prevent unauthorized update_option() calls that could reopen registration or corrupt critical options like 'wp_user_roles'.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you should check if the User Activity Log plugin version is up to and including 2.2, as these versions are vulnerable. Since the vulnerability involves unauthenticated attackers pushing site options via update_option() calls, monitoring for unexpected changes to site options such as 'users_can_register' or 'wp_user_roles' can help detect exploitation attempts. You can query the WordPress options table for suspicious changes. For example, use the following SQL command on your WordPress database to check for recent changes to these options: SELECT option_name, option_value, autoload FROM wp_options WHERE option_name IN ('users_can_register', 'wp_user_roles'); Additionally, monitor your web server logs for POST requests to wp-login.php or admin-ajax.php that include suspicious parameters attempting to update options. You can use commands like: 1. To search web server logs for failed login attempts: grep 'wp-login.php' /var/log/apache2/access.log | grep 'POST' 2. To detect unusual option update requests, you might use a network monitoring tool or a WordPress activity log plugin that logs option updates. Since the plugin logs user activities in the 'wp_ualp_user_activity' table, reviewing entries for unexpected or unauthenticated actions might also help detect exploitation attempts. [2]

Useful 0 Not Useful 0