CVE-2025-13471: Unknown User Activity Log

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)

Affected products

• Unknown User Activity Log: up to and including 2.2

Published 2026-01-28. Last modified 2026-06-17.