5.3

CVE-2025-13471

User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
Mögliche Gegenmaßnahme
User Activity Log: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerUnknown
≫
Produkt User Activity Log
Default Statusunknown
Version <= 2.2
Version 0
Status affected
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt User Activity Log
Version *-2.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.175
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/
https://www.wordfence.com/threat-intel/vulnerabilities/id/2c931bd2-8c19-4211-9378-f32a1302defd
Third Party Advisory