Live › vulnerability › CVE-2026-116610
Go to dashboardThe Clean Login WordPress plugin up to and including 1.20.1 is missing a capability check on its save_post handler. A logged-in Contributor can embed the plugin's shortcodes in their own post and overwrite the login, register, restore, edit and change-password page settings with that post's ID and permalink.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running Clean Login 1.20.1 or older that have users with Contributor access or higher, since those accounts can change the plugin's login-related page settings. Sites without the plugin, on a newer version, or with no users above Subscriber can skip it.
No product ranges from the sources yet.
wp plugin list on the server; affected versions are 1.20.1 and below.wp user list --role=contributor and similar roles for Author and Editor.1.20.1; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.
This page as .md · .json · in your agent: get_signal("CVE-2026-116610")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.