CVE-2026-90976: Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/clean-loginto a version that resolves this vulnerability.Fixed in 1.19
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit the vulnerable registration handler. No existing account, user interaction, or special privileges are required.
Are sites with WordPress registration disabled still affected?
Yes. The affected handler creates accounts without checking whether site-wide user registration is enabled, so disabling registration does not prevent exploitation.
Which plugin versions are affected?
Clean Login versions before 1.19 are affected. Updating to version 1.19 or later addresses the issue.
How can I determine whether exploitation may have occurred?
Review WordPress user accounts for unexpected or unauthorized accounts, particularly accounts created while registration was disabled. Also verify whether the site was running a Clean Login version earlier than 1.19.