The User Activity Log WordPress plugin versions up to 2.2 contains a flaw that allows an unauthenticated user to influence configuration values during the processing of failed login attempts. An attacker can set arbitrary options to the value "1", for example turning User Registration on when it has been disabled. This grants the attacker the ability to change site settings without authorization, potentially enabling unwanted user accounts. The weakness involves improper input validation and configuration manipulation, corresponding to CWE‑639.

WordPress sites running the User Activity Log plugin version 2.2 or earlier are affected. The plugin is identified as "Unknown:User Activity Log" in CNA records, with no specific vendor listed.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An unauthenticated user can exploit the flaw by triggering a failed login attempt that reaches the plugin’s option update logic. No advanced privileges or additional conditions are required beyond sending HTTP requests to the site.