What is the CVSS score of CVE-2026-54184?

CVE-2026-54184 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Clean Login are affected by CVE-2026-54184?

The Clean Login WordPress plugin (versions 1.15 and earlier) contains an insecure direct object reference vulnerability that permits unauthenticated attackers to modify data and disable plugin…

How to fix or mitigate CVE-2026-54184?

24 hours: Audit installed WordPress plugins across all systems; identify instances running Clean Login version ≤1.15; review access logs for suspicious activity targeting plugin endpoints. 7 days: Assess business criticality of the plugin; if non-essential, deactivate and remove immediately. If required for operations, implement network-level access controls restricting plugin administrative endpoints to authorized IPs only. 30 days: Monitor Patchstack and official WordPress plugin repository for vendor patch release; plan transition to alternative authentication plugin if patch is not released within 60 days.

Clean Login CVE-2026-54184

EUVD-2026-37629 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-17 Patchstack

WordPress Authentication Bypass Wordpress Plugin Clean Login

8.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

8.2 HIGH

WordPress plugin endpoint reachable over HTTP without auth or interaction (AV:N/AC:L/PR:N/UI:N); IDOR lets attacker tamper with plugin-managed records (I:L) and break login (A:H), no data disclosure stated (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:59 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

AnalysisAI

Insecure direct object reference in the Clean Login WordPress plugin versions 1.15 and earlier allows remote unauthenticated attackers to manipulate object identifiers to modify data they should not control and to disrupt plugin-managed functionality. The flaw is reported by Patchstack and tagged as an authentication bypass affecting Alberto Hornero's Clean Login plugin, with no public exploit identified at time of analysis. CVSS 3.1 rates it 8.2 due to the network-reachable, no-privileges, no-interaction vector with limited integrity impact and high availability impact.

Technical ContextAI

Clean Login is a third-party WordPress plugin by author Alberto Hornero (CPE cpe:2.3:a:alberto_hornero:clean_login) that provides front-end login, registration, and account management forms as a substitute for the default WP-Admin flows. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of bug in which an HTTP parameter such as a user ID, token, or record ID is trusted by the server without verifying that the requester actually owns or is permitted to act on that object. In practice this typically means a plugin endpoint reads an identifier from a GET/POST parameter or AJAX action and performs a lookup, update, or deletion against the target object without re-checking the current session's capabilities or ownership.

RemediationAI

No vendor-released patch identified at time of analysis; the input lists only the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/clean-login/vulnerability/wordpress-clean-login-plugin-1-15-insecure-direct-object-references-idor-vulnerability) and no fix version, so administrators should monitor that page and the plugin's WordPress.org repository for a release greater than 1.15 and upgrade as soon as it ships. Until a fixed release is available, the highest-confidence compensating control is to deactivate and uninstall the Clean Login plugin and revert to standard wp-login.php (trade-off: any custom front-end login/registration pages provided by Clean Login will stop working, requiring shortcode/template cleanup). If removal is not acceptable, restrict access to the Clean Login front-end endpoints and any plugin-specific admin-ajax.php or REST actions via a WAF or web-server ACL - for example a Patchstack/Wordfence virtual patch, or nginx/Apache rules that require an authenticated session cookie for the relevant URLs (trade-off: legitimate self-service registration and password reset are also blocked for unauthenticated visitors).