A critical vulnerability in the User Activity Log plugin allows unauthenticated attackers to modify sensitive site settings, potentially leading to administrative access corruption.

This flaw stems from a missing authorization check in the ual_shook_wp_login_failed function, which permits unauthenticated attackers to update specific site options. By injecting malicious input into the failed-login handler, an attacker can modify global settings such as user registration status or WordPress user roles.

The ability for an unauthenticated attacker to manipulate site options presents a severe risk to site integrity and availability. Successful exploitation could allow an attacker to enable unauthorized account registration or corrupt the wp_user_roles table, effectively locking administrators out of their own dashboards and facilitating a full site takeover or denial of service. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent unauthorized configuration changes.

Immediate Action: Since no official patch is currently identified, administrators should immediately deactivate and remove the User Activity Log plugin until a secure version is released by the vendor.

Proactive Monitoring: Review WordPress site option tables and user role configurations for unauthorized modifications or unexpected changes to registration settings.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests directed at the WordPress login or authentication handling endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Given the ease with which unauthenticated attackers can modify critical site settings, this vulnerability poses a significant risk to the security posture of any WordPress instance running the affected plugin. Administrators are strongly urged to prioritize the immediate deactivation of the User Activity Log plugin. Vigilance in monitoring for configuration changes is essential until the vendor provides a verified security update.