CVE-2025-13471

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
Published: 2026-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/cc8743f5-b1b9-4f88-b440-db044034bbfc/

Check your stack JSON