The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes() function hooked to the savepost action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's clloginurl/clloginid/clregisterurl/clregisterid/clrestoreurl/clrestoreid/clediturl/cleditid/clchangepasswordurl/clchangepasswordid options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.