CVE-2025-13471

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Jan 28, 2026

CISA due date

—

The record

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)

Affected packages

Ecosystem	Package	Introduced	Fixed