Clean Login WordPress plugin vulnerabilities

The Clean Login plugin for WordPress in versions up to and including 1.20.1 is vulnerable to missing authorization due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. An authenticated attacker with Contributor-level access can overwrite the plugin's cl_login_url, cl_login_id, cl_register_url, cl_register_id, cl_restore_url, cl_restore_id, cl_edit_url, cl_edit_id, cl_change_password_url, and cl_change_password_id options with the ID and permalink of a post they authored by embedding the plugin's shortcodes in their own post content.

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler. This allows unauthenticated users to create accounts even when the site has registration disabled.