2026-01-07 08:21:49
Wordfence
PUBLISHED
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler ual_shook_wp_login_failed lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like wp_user_roles, breaking wp-admin access.