CVE-2026-116610
Received Received - Intake

Missing Authorization in Clean Login WordPress Plugin

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Wordfence

Description
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-116610
EUVD
EUVD-2026-111597

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hornero Clean Login 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Clean Login WordPress plugin up to version 1.20.1 has a missing authorization vulnerability. The plugin's shortcode function lacks a capability check, allowing authenticated users with Contributor access or higher to modify plugin settings by embedding shortcodes in their posts. This could let attackers change URLs and IDs used by the plugin.

Detection Guidance

To detect this vulnerability, check WordPress sites running the Clean Login plugin versions up to 1.20.1. Look for unauthorized changes to plugin settings like cl_login_url or cl_register_url. Review posts by Contributor-level users for embedded plugin shortcodes. Use commands like grep to search for shortcode usage in post content.

Impact Analysis

If exploited, this vulnerability could allow attackers to alter plugin settings, potentially redirecting login or registration pages to malicious destinations. Users might be tricked into disclosing credentials or other sensitive information on fake pages.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by allowing unauthorized modification of WordPress site settings. If attackers change plugin options, it might alter user authentication or registration processes, potentially violating data protection requirements for handling user credentials or personal data.

Mitigation Strategies

Update the Clean Login plugin to the latest version beyond 1.20.1 to ensure the missing authorization vulnerability is patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart