Input validation vulnerability in User Activity Log 1.6.2

The User Activity Log plugin for WordPress is vulnerable to a security exploit called SQL Injection. This is a type of attack that takes advantage of a bug in the plugin to gain access to sensitive information from the database. The attack is possible if the login_failed_non_existing_user option is enabled and works by exploiting a flaw in the ual_shook_wp_login_failed function, which is found in versions up to and including 1.6.2. The flaw is caused by insufficient escaping of the user supplied parameter and lack of preparation on the existing SQL query.