CVE-2025-13471: 
WordPress vulnerability analysis and mitigation

CVE-2025-13471 is an unauthenticated limited arbitrary option update vulnerability in the User Activity Log WordPress plugin through version 2.2. The flaw allows unauthenticated attackers to set arbitrary WordPress options to the value 1 by exploiting improper handling of failed login attempts — for example, enabling user registration on sites where it has been disabled. It was discovered by researcher Alex Tselevich (nos3curity), added to WPScan's database on 2025-12-30, and publicly published on 2026-01-06. It carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, Red Hat CVE).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) under CWE-639 (Authorization Bypass Through User-Controlled Key) and maps to OWASP Top 10 A5: Broken Access Control (WPScan). The root cause is that the plugin's failed login logging mechanism does not properly validate or sanitize the log parameter submitted to wp-login.php before using it to update WordPress options. When the plugin is configured with "Keep Failed Login Logs" set to "Keep" and "Number of failed login for non-existing user" set to 1, an unauthenticated attacker can submit a crafted POST request to wp-login.php using an arbitrary WordPress option name as the username field, causing the plugin to set that option's value to 1. No authentication or special privileges are required, and the attack is network-accessible with low complexity.

Successful exploitation allows an unauthenticated attacker to set any WordPress site option to the integer value 1, which can have significant security consequences depending on the targeted option. The most notable example is enabling open user registration (users_can_register) on sites where it has been deliberately disabled, potentially allowing attackers to create accounts and escalate privileges further. While the impact is limited to boolean-style options (value forced to 1), the ability to manipulate core site configuration without authentication represents a meaningful integrity risk (WPScan).

A public proof-of-concept (PoC) is included in the WPScan advisory, demonstrating exploitation via a single curl command requiring no authentication. The EPSS score is very low at 0.000070, and there is no evidence of active in-the-wild exploitation or inclusion in the CISA KEV catalog at this time. No threat actor attribution has been reported (WPScan, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the User Activity Log plugin version ≤ 2.2. This can be done via passive enumeration (e.g., checking /wp-content/plugins/user-activity-log/) or using tools like WPScan.
2. Verify plugin configuration: The exploit requires the plugin to be configured with "Keep Failed Login Logs" set to "Keep" and "Number of failed login for non-existing user" set to 1 (the default settings).
3. Craft the malicious request: Send a POST request to wp-login.php using the target WordPress option name as the log (username) parameter and any value as the password:

curl -X POST https://example.com/wp-login.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "log=users_can_register&pwd=anything&wp-submit=Log+In"

4. Option updated: The plugin processes the failed login attempt and sets the WordPress option named users_can_register (or whichever option was specified) to 1.
5. Leverage the change: If user registration was enabled, the attacker can now register an account on the site and potentially escalate privileges through other means (WPScan).

• Network: Unusual POST requests to /wp-login.php where the log parameter contains WordPress option names (e.g., users_can_register, default_role) rather than actual usernames; high volume of failed login attempts from a single IP targeting non-existent usernames.
• Logs: WordPress authentication logs or server access logs showing repeated wp-login.php POST requests with option-name-like values in the log field; plugin activity logs recording failed login events for usernames matching WordPress option names.
• WordPress Database: Unexpected changes to the wp_options table, particularly options such as users_can_register being set to 1 without corresponding admin activity; review option_value changes with timestamps correlating to suspicious login attempts.

As of the disclosure date, there is no known fix available for the User Activity Log plugin through version 2.2 (WPScan). Site administrators should consider deactivating or removing the plugin until a patched version is released. As a workaround, changing the plugin's "Number of failed login for non-existing user" setting away from 1, or disabling the "Keep Failed Login Logs" feature, may reduce exposure. Additionally, monitoring the wp_options table for unexpected changes and implementing a Web Application Firewall (WAF) rule to block suspicious wp-login.php POST requests can help mitigate risk.

The vulnerability was discovered and responsibly disclosed by researcher Alex Tselevich (nos3curity), who also published a technical write-up at nosecurity.blog. WPScan verified and published the advisory, classifying it as a confirmed IDOR vulnerability (WPScan). No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation.