CVE-2025-11877: Solwininfotech User Activity Log

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.

Affected products

• Solwininfotech User Activity Log: up to and including 2.2

Published 2026-01-07. Last modified 2026-06-17.