CVE-2026-116610 in Clean Login Plugin
Summary
by MITRE • 10/28/2026
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Clean Login WordPress plugin, specifically in versions up to 1.20.1, contains a critical security flaw classified as Missing Authorization within its shortcode handling mechanism. This vulnerability stems from an insufficient capability check implemented on the CleanLogin_Shortcode::get_pages_with_shortcodes function, which is triggered via the save_post action hook. In WordPress architecture, hooks like save_post are executed whenever post content or metadata is updated, regardless of whether the update originates from a standard editor interface or programmatic API calls. The absence of proper permission verification in this specific context allows any authenticated user with Contributor-level access and above to manipulate internal plugin settings without requiring Administrator privileges. This represents a significant deviation from the principle of least privilege, as lower-privileged users are granted administrative control over security-critical configuration parameters through standard content editing workflows.
The technical exploitation of this vulnerability relies on the interaction between WordPress post metadata storage and the Clean Login plugin's shortcode processing logic. When an attacker with Contributor-level access creates or edits a post containing specific shortcodes provided by the Clean Login plugin, the save_post hook is invoked. Due to the missing authorization check, the get_pages_with_shortcodes function processes these inputs without verifying if the user has the necessary permissions to modify global configuration options. Consequently, the attacker can inject values that correspond to their own authored posts into sensitive option fields such as cl_login_url, cl_register_url, and others related to login, registration, restoration, editing, and password change functionalities. By embedding shortcodes in post content, the attacker effectively overwrites these critical URLs and IDs with references to pages under their control or manipulation, thereby redirecting authentication flows away from legitimate administrative endpoints.
The operational impact of this vulnerability is severe, as it allows for potential account takeover, unauthorized access, and disruption of service through phishing-like redirections. By altering the login or registration URLs, an attacker can direct users attempting to authenticate toward maliciously crafted pages that mimic the original site but capture credentials. This aligns with common attack patterns found in industry standards such as CWE-269, which addresses Improper Privilege Management, and specifically relates to CWE-862 regarding Missing Authorization. Furthermore, this behavior mirrors techniques documented in the MITRE ATT&CK framework under T1078, Valid Accounts, where attackers leverage legitimate credentials to maintain persistence or escalate privileges by manipulating authentication mechanisms. The ability to modify these settings without administrative oversight undermines the integrity of the WordPress installation and compromises user trust, as victims may unknowingly submit sensitive information to attacker-controlled endpoints.
Mitigation strategies must focus on immediate remediation through software updates and enhanced access controls. Administrators should upgrade the Clean Login plugin to a version greater than 1.20.1 where this authorization gap has been addressed by developers implementing proper capability checks before processing shortcode inputs in post save operations. In environments where upgrading is not immediately feasible, temporary mitigations include restricting Contributor-level users from publishing posts that contain shortcodes or disabling specific hooks if possible through custom code patches that enforce strict permission verification using functions like current_user_can with appropriate capabilities such as manage_options. Additionally, implementing Web Application Firewalls can help detect and block anomalous requests attempting to modify these options via post metadata updates. Regular auditing of user permissions and monitoring for unexpected changes in plugin configuration files or database entries are also recommended practices to maintain the security posture of WordPress installations against similar privilege escalation vulnerabilities.