CVE-2026-90976
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler. This allows unauthenticated users to create accounts even when the site has registration disabled.
Risk Assessment
Attackers can create accounts against the site's configuration, leading to unauthorized access and potential abuse. This may violate the organization's security policy and pollute the user base.
Recommendation
Update the Clean Login plugin to version 1.19 or later. Until then, consider disabling the plugin entirely or monitoring for unusual registrations.
Other vulnerabilities in Clean Login WordPress plugin
See all- CVE-2026-116610Medium
The Clean Login plugin for WordPress in versions up to and including 1.20.1 is vulnerable to missing authorization due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. An authenticated attacker with Contributor-level access can overwrite the plugin's cl_login_url, cl_login_id, cl_register_url, cl_register_id, cl_restore_url, cl_restore_id, cl_edit_url, cl_edit_id, cl_change_password_url, and cl_change_password_id options with the ID and permalink of a post they authored by embedding the plugin's shortcodes in their own post content.
- CVE-2026-90977Medium
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
Original NVD description (English source)
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS