{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13471", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-11-20T08:38:24.493Z", "datePublished": "2026-01-28T06:00:03.740Z", "dateUpdated": "2026-04-02T12:39:54.086Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-02T12:39:54.086Z"}, "title": "User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update", "problemTypes": [{"descriptions": [{"description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "User Activity Log", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "2.2"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)"}], "references": [{"url": "https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Alex Tselevich (nos3curity)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T21:20:13.265374Z", "id": "CVE-2025-13471", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T21:20:57.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-13471", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T21:20:13.265374Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T21:20:53.912Z"}}], "cna": {"title": "User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alex Tselevich (nos3curity)"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "User Activity Log", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2"}], "defaultStatus": "unknown"}], "references": [{"url": "https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-02T12:39:54.086Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13471", "state": "PUBLISHED", "dateUpdated": "2026-04-02T12:39:54.086Z", "dateReserved": "2025-11-20T08:38:24.493Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-01-28T06:00:03.740Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)"}, {"lang": "es", "value": "El plugin de WordPress User Activity Log hasta la versi\u00f3n 2.2 no gestiona adecuadamente los intentos de inicio de sesi\u00f3n fallidos en algunos casos, permitiendo a usuarios no autenticados establecer opciones arbitrarias a 1 (por ejemplo, para habilitar el Registro de Usuarios cuando ha sido desactivado)"}], "id": "CVE-2025-13471", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-01-28T06:15:47.477", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred"}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T21:08:11.952255+00:00", "value": {"mitigation_remediation": ["Update User Activity Log to the latest version (above 2.2) released by the vendor.", "If an update is unavailable, temporarily disable the plugin to block unauthenticated access to the configuration interface.", "Review and restrict the plugin\u2019s configuration settings after restoring access, ensuring User Registration remains disabled if desired."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Configuration Change"}, "threat_synthesis": {"affected_systems": "WordPress sites running the User Activity Log plugin version 2.2 or earlier are affected. The plugin is identified as \"Unknown:User Activity Log\" in CNA records, with no specific vendor listed.", "description_and_impact": "The User Activity Log WordPress plugin versions up to 2.2 contains a flaw that allows an unauthenticated user to influence configuration values during the processing of failed login attempts. An attacker can set arbitrary options to the value \"1\", for example turning User Registration on when it has been disabled. This grants the attacker the ability to change site settings without authorization, potentially enabling unwanted user accounts. The weakness involves improper input validation and configuration manipulation, corresponding to CWE\u2011639.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. An unauthenticated user can exploit the flaw by triggering a failed login attempt that reaches the plugin\u2019s option update logic. No advanced privileges or additional conditions are required beyond sending HTTP requests to the site."}}}}, "created": "2026-01-29T09:18:10.617255+00:00", "updated": "2026-04-27T21:15:05.545896+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"], "weaknesses": ["CWE-639"]}