VulnSocial

CVE-2025-11877General

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • General: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-02-02: 102-02
Signal classification1 categories
General
1100.0%
Full discourse1 post
  • David@DavidMarquet19
    General

    📌 Top CVEs recientes (CVSS>=7.0): 1. 🚪 CVE-2025-14070 (CVSS: 7.5) 2. 📂 CVE-2025-13801 (CVSS: 7.5) 3. 🚪 CVE-2025-13493 (CVSS: 7.5) 4. 🕵️‍♂️ CVE-2025-13371 (CVSS: 8.6) 5. 🚪 CVE-2025-11877 (CVSS: 7.5) #CyberSecurity #CVE #Infosec

    Post summary

    The tweet lists several high‑CVSS CVEs but provides no further details on exploitation, patches, or technical characteristics.

    0000049
    169 followersView on X

Explore more

Back to dashboard