CVE-2025-11877: User Activity Log Auth Bypass Vulnerability

CVE-2025-11877 Overview

CVE-2025-11877 affects the User Activity Log plugin for WordPress in versions up to and including 2.2. The plugin's failed-login handler ual_shook_wp_login_failed lacks a capability check and writes failed usernames directly into update_option() calls. Unauthenticated attackers can push select site options from 0 to a non-zero value through crafted failed login attempts. This allows attackers to reopen user registration or corrupt critical options such as wp_user_roles, breaking wp-admin access. The flaw is classified under CWE-862: Missing Authorization. CVE-2025-13471 appears to be a duplicate of this CVE.

Critical Impact

Unauthenticated attackers can corrupt WordPress site options, reopen public registration, and break administrative access by triggering the unprotected failed-login logging path.

Affected Products

• WordPress User Activity Log plugin versions up to and including 2.2
• WordPress sites with the plugin active and accepting login attempts
• Sites relying on wp_user_roles integrity for administrative access

Discovery Timeline

• 2026-01-07 - CVE-2025-11877 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11877

Vulnerability Analysis

The User Activity Log plugin registers ual_shook_wp_login_failed as a handler for the wp_login_failed action. WordPress fires this action whenever a login attempt fails, including attempts that originate from unauthenticated visitors. The handler processes the supplied username and writes the value into the WordPress options table through update_option() without first verifying the caller's capabilities or sanitizing the option targets it touches.

Because the action runs in an unauthenticated context, any visitor can reach the vulnerable code path by submitting a failing login request. The handler's option writes can flip select site options from a 0 value to a non-zero value. Attackers can leverage this primitive to enable the users_can_register option, opening the site to mass account creation, or to corrupt the serialized wp_user_roles option, severing administrative role definitions and locking legitimate admins out of wp-admin.

Root Cause

The root cause is missing authorization on a privileged side effect. The wp_login_failed hook is intentionally reachable pre-authentication, but the handler treats attacker-controlled login form input as trusted data and forwards it into update_option() without a current_user_can() check or an allow-list of target options.

Attack Vector

The vulnerability is exploitable remotely over the network with no authentication and no user interaction. An attacker sends crafted POST requests to wp-login.php with username values designed to manipulate the option keys or values the handler writes. Repeated requests can deterministically transition target options from 0 to attacker-influenced non-zero states. Refer to the Wordfence Vulnerability Report and the WordPress User Functions Code for the affected handler implementation.

Detection Methods for CVE-2025-11877

Indicators of Compromise

• Unexpected changes to users_can_register flipping from 0 to 1 in the wp_options table
• Corruption or unexpected serialization of the wp_user_roles option entry
• Bursts of failed login attempts from a single source preceding option changes
• Loss of wp-admin access for previously valid administrator accounts

Detection Strategies

• Compare current values of sensitive options against a known-good baseline, focusing on users_can_register, default_role, and wp_user_roles
• Inspect web server access logs for high-volume POST requests to wp-login.php containing unusual or structured username payloads
• Audit the wp_options table for recent option_value modifications timestamped near suspicious login activity

Monitoring Recommendations

• Enable WordPress audit logging on option changes and forward events to a central SIEM
• Alert on any modification to wp_user_roles or sudden enablement of public registration
• Correlate failed login spikes with subsequent administrative anomalies such as new user creation

How to Mitigate CVE-2025-11877

Immediate Actions Required

• Deactivate the User Activity Log plugin on all WordPress sites running version 2.2 or earlier until a fixed release is installed
• Restore wp_user_roles and users_can_register to known-good values if tampering is detected
• Reset administrator credentials and review recently created accounts for unauthorized additions

Patch Information

No fixed version is recorded in the NVD entry at the time of publication. Site administrators should monitor the Wordfence Vulnerability Report and the plugin's repository for an updated release that adds capability checks to the ual_shook_wp_login_failed handler.

Workarounds

• Remove or disable the User Activity Log plugin until a patched version is available
• Place wp-login.php behind an authentication layer such as HTTP basic auth or an IP allow-list to block unauthenticated access to the failed-login hook
• Deploy a Web Application Firewall rule that rate-limits and inspects POST requests to wp-login.php for anomalous username payloads

# Apache example: restrict wp-login.php to trusted IPs
<Files "wp-login.php">
    Require ip 203.0.113.0/24
    Require ip 198.51.100.42
</Files>