CVE-2026-116610: Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes() function hooked to the savepost action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's clloginurl/clloginid/clregisterurl/clregisterid/clrestoreurl/clrestoreid/clediturl/cleditid/clchangepasswordurl/clchangepasswordid options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker must be able to create a post containing Clean Login shortcodes.
What happens when the issue is exploited?
The attacker can overwrite Clean Login URL and ID options for login, registration, password restoration, profile editing, and password changing. The replacement values point to a post authored by the attacker.
Is unauthenticated exploitation possible?
No. Exploitation requires an authenticated account with at least Contributor permissions.
How can I identify possible exploitation?
Review the Clean Login cl_login_url, cl_login_id, cl_register_url, cl_register_id, cl_restore_url, cl_restore_id, cl_edit_url, cl_edit_id, cl_change_password_url, and cl_change_password_id options. Investigate values that reference posts created by Contributor-level or otherwise untrusted users.