User Activity Log Plugin up to 2.2 on WordPress Options Update update_option improper authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in User Activity Log Plugin up to 2.2 on WordPress. Impacted is the function update_option of the component Options Update Handler. Such manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2025-11877. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in User Activity Log Plugin up to 2.2 on WordPress and classified as critical. Affected by this issue is the function update_option of the component Options Update Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. CVE summarizes:

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access.

The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2025-11877. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/07/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Name

• User Activity Log Plugin

Version

• 2.0
• 2.1
• 2.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion