{"id":"CVE-2026-116610","kind":"vulnerability","aliases":["CVE-2026-116610"],"related":[],"title":"Clean Login WordPress plugin lets contributors overwrite login page settings","description":"The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.","summary":"The Clean Login WordPress plugin up to and including 1.20.1 is missing a capability check on its save_post handler. A logged-in Contributor can embed the plugin's shortcodes in their own post and overwrite the login, register, restore, edit and change-password page settings with that post's ID and permalink.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clean-login","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["newer-than-1.20.1","no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Clean Login plugin version in wp-admin Plugins, or run `wp plugin list` on the server; affected versions are `1.20.1` and below.\n- List users with the Contributor role or higher with `wp user list --role=contributor` and similar roles for Author and Editor.","fix":"- Update the Clean Login plugin to a release newer than `1.20.1`; the sources do not name the fixed version.\n- Until updated, remove or restrict Contributor-level accounts on the site.","status":"open","published_at":"2026-10-28T07:16:47+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:33:32+00:00","updated_at":"2026-10-28T07:33:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T07:33:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Clean Login plugin to a release newer than `1.20.1`; the sources do not name the fixed version.\n- Until updated, remove or restrict Contributor-level accounts on the site.","reach":"internet","title":"Clean Login WordPress plugin lets contributors overwrite login page settings","impact":"medium","summary":"The Clean Login WordPress plugin up to and including 1.20.1 is missing a capability check on its save_post handler. A logged-in Contributor can embed the plugin's shortcodes in their own post and overwrite the login, register, restore, edit and change-password page settings with that post's ID and permalink.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","clean-login","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Contributor redirects the plugin's login and account pages to attacker-chosen posts","analyst_note":"","how_to_check":"- Check the installed Clean Login plugin version in wp-admin Plugins, or run `wp plugin list` on the server; affected versions are `1.20.1` and below.\n- List users with the Contributor role or higher with `wp user list --role=contributor` and similar roles for Author and Editor.","needs_analyst":false,"not_affected_if":["plugin-not-installed","newer-than-1.20.1","no-contributor-accounts"],"who_is_affected":"Sites running Clean Login `1.20.1` or older that have users with Contributor access or higher, since those accounts can change the plugin's login-related page settings. Sites without the plugin, on a newer version, or with no users above Subscriber can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.001084,"input_tokens":3469,"output_tokens":1475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116610':13A,16A '-2026':12A,15A '1.20.1':37B,100C 'access':133C 'action':121C 'attack':128C 'authent':127C 'author':93C,155C 'capabl':41B,105C 'chang':72B 'change-password':71B 'check':42B,106C 'cl':141C 'clean':1A,18B,29B,84C 'clean-login':17B 'cleanlogin':109C 'content':167C 'contributor':6A,52B,131C 'contributor-level':130C 'cve':11A,14A 'due':101C 'edit':69B 'emb':54B 'embed':158C 'function':115C 'get':111C 'handler':47B 'hook':116C 'host':23B 'id':80B,147C 'includ':36B,99C 'let':5A 'level':132C 'log':50B 'logged-in':49B 'login':2A,8A,19B,30B,66B,85C,142C 'make':123C 'miss':39B,92C,104C 'option':144C 'overwrit':7A,64B,137C 'packag':20B 'page':9A,74B,112C 'password':73B 'permalink':82B,149C 'plugin':4A,27B,32B,56B,86C,139C,160C 'possibl':125C 'post':46B,62B,78B,120C,152C,166C 'regist':67B 'restor':68B 'save':45B,119C 'self':22B 'self-host':21B 'set':10A,75B 'shortcod':58B,110C,114C,162C 'simpli':156C 'url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id':143C 'version':95C 'vulner':90C 'wordpress':3A,24B,26B,31B,88C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running Clean Login `1.20.1` or older that have users with Contributor access or higher, since those accounts can change the plugin's login-related page settings. Sites without the plugin, on a newer version, or with no users above Subscriber can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116610","severity":null,"published_at":"2026-10-28T07:16:47+00:00","modified_at":"2026-10-28T07:16:47+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}