https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:59:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-282549 EUVD-2026-282549 https://cve.radiocsirt.org/vuln/euvd-2026-282549 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11877 <p>The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler &#39;ual_shook_wp_login_failed&#39; lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like &#39;wp_user_roles&#39;, breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.</p> <p>The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler &#39;ual_shook_wp_login_failed&#39; lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like &#39;wp_user_roles&#39;, breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-11877 https://cve.radiocsirt.org/vuln/ghsa-69mj-pc6r-5cgv <p>The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler &#39;ual_shook_wp_login_failed&#39; lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like &#39;wp_user_roles&#39;, breaking wp-admin access.</p> <p>The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler &#39;ual_shook_wp_login_failed&#39; lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like &#39;wp_user_roles&#39;, breaking wp-admin access.</p> https://cve.radiocsirt.org/vuln/ghsa-69mj-pc6r-5cgv