CVE-2026-90977 in Clean Login Plugin
Summary
by MITRE • 09/18/2026
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in versions of the Clean Login WordPress plugin prior to release 1.19 represents a critical authentication logic flaw that undermines the integrity of user account creation processes. This specific weakness stems from an improper validation mechanism within the plugin's registration handler, where the system fails to enforce the presence and correctness of CAPTCHA challenges under certain state conditions. Specifically, when the server-side session variable intended to track whether a CAPTCHA has been successfully solved is found to be empty or null, the application logic incorrectly defaults to allowing the registration request to proceed without requiring the user to interact with the anti-automation control. This behavior effectively neutralizes one of the primary defenses against automated bot attacks and credential stuffing campaigns on WordPress sites that rely on this plugin for managing social login or custom registration forms.
From a technical perspective, this flaw is classified as an improper check before performing an action, which aligns directly with CWE-489 in the Common Weakness Enumeration database. The root cause lies in the conditional logic used to verify CAPTCHA completion; rather than treating an empty session state as a failure condition that requires re-validation or rejection of the request, the code treats it as a pass-through scenario. This oversight allows unauthenticated actors to bypass the anti-bot measures entirely by simply omitting or manipulating the session data associated with the registration form submission. In many web application frameworks, relying on server-side sessions for security-critical decisions without robust fallbacks can lead to such state confusion vulnerabilities, where the absence of expected data is misinterpreted as permission rather than an error condition requiring stricter validation.
The operational impact of this vulnerability is significant for any WordPress installation utilizing Clean Login for user registration or social login integration. By bypassing the CAPTCHA requirement, attackers can automate the creation of thousands of fake accounts in a short period with minimal computational resources and no human intervention. These fabricated accounts are frequently used as footholds for further malicious activities, including spamming comment sections, posting phishing links, conducting brute-force attacks against other user credentials stored on the platform, or manipulating site metrics and content moderation systems. The ability to create unauthenticated accounts also facilitates social engineering campaigns where attackers establish legitimate-looking profiles before launching targeted attacks against specific users or administrators within the WordPress ecosystem.
This vulnerability maps closely to several techniques in the MITRE ATT&CK framework for enterprise security. It falls under the tactic of Initial Access, specifically aligning with T1078 Valid Accounts, as it allows adversaries to obtain valid credentials through automated means without proper verification. Furthermore, because it involves bypassing a control designed to prevent automation, it relates to T1592 Gather Victim Host Information or more broadly to evasion techniques that allow attackers to blend in by creating legitimate-looking accounts quickly. The exploitation of this flaw does not require complex payload delivery or network-level exploits; instead, it relies on simple HTTP request manipulation where the attacker ensures the session token related to CAPTCHA verification is absent during the POST request for account creation.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective solution is to upgrade the Clean Login plugin to version 1.19 or later, where this logic error has been corrected by ensuring that registration requests are rejected if the CAPTCHA verification status cannot be confirmed via a valid session state. Administrators who cannot immediately update should consider implementing alternative anti-bot measures at the web server level using tools like ModSecurity rules or cloud-based Web Application Firewalls to detect and block automated registration patterns based on request frequency, user-agent strings, and IP reputation scores. Additionally, enabling rate limiting for login and registration endpoints can significantly reduce the effectiveness of any remaining automation attempts by throttling requests from single sources until they are verified as human-driven interactions.