CVE-2026-90977
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
Risk Assessment
Attackers can mass-create accounts on the site, leading to spam, abuse, and a polluted user base. This may also serve as a foothold for further attacks using the created accounts.
Recommendation
Update the Clean Login plugin to version 1.19 or later. Until then, consider disabling registration or adding extra anti-spam protection.
Other vulnerabilities in Clean Login WordPress plugin
See all- CVE-2026-116610Medium
The Clean Login plugin for WordPress in versions up to and including 1.20.1 is vulnerable to missing authorization due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. An authenticated attacker with Contributor-level access can overwrite the plugin's cl_login_url, cl_login_id, cl_register_url, cl_register_id, cl_restore_url, cl_restore_id, cl_edit_url, cl_edit_id, cl_change_password_url, and cl_change_password_id options with the ID and permalink of a post they authored by embedding the plugin's shortcodes in their own post content.
- CVE-2026-90976Medium
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler. This allows unauthenticated users to create accounts even when the site has registration disabled.
Original NVD description (English source)
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS