Clean Login
Monthly
Insecure direct object reference in the Clean Login WordPress plugin versions 1.15 and earlier allows remote unauthenticated attackers to manipulate object identifiers to modify data they should not control and to disrupt plugin-managed functionality. The flaw is reported by Patchstack and tagged as an authentication bypass affecting Alberto Hornero's Clean Login plugin, with no public exploit identified at time of analysis. CVSS 3.1 rates it 8.2 due to the network-reachable, no-privileges, no-interaction vector with limited integrity impact and high availability impact.
Missing authorization in the Clean Login plugin for WordPress through version 1.20.1 allows any authenticated user with Contributor-level access or higher to hijack the plugin's front-end page mapping: the save_post-hooked CleanLogin_Shortcode::get_pages_with_shortcodes() routine runs without a current_user_can() check, so a Contributor who embeds the plugin's shortcodes in a post they authored can have the plugin's cl_login_url, cl_register_url, cl_restore_url, cl_edit_url and cl_change_password_url options (plus their matching ID values) overwritten with the ID and permalink of that attacker-owned post. Impact is limited to integrity of those plugin settings - no confidentiality or availability effect and no code execution - and exploitation is impossible without a valid low-privilege account on a site running the plugin. There is no CISA KEV entry and no public exploit identified at time of analysis; the overall priority is medium-to-low, with the practical risk concentrated on sites that hand Contributor accounts to untrusted users.
Bypass of the registration CAPTCHA in the WordPress Clean Login plugin before 1.19 allows unauthenticated attackers to create accounts without solving the challenge when the stored session value is empty. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) was reported, and our independent assessment rates this as a genuine low-to-moderate priority issue because the impact is limited to spam and automation abuse rather than compromise of existing accounts or the server. The vendor has released version 1.19 as the fixed release.
The Clean Login WordPress plugin before 1.19 lets unauthenticated attackers create user accounts on sites where registration is disabled, bypassing an administrative control intended to prevent open sign-ups. The registration handler fails to check the site's registration-enabled setting, so even locked-down sites become vulnerable; impact is limited to unauthorized low-privilege account creation (CVSS I:L) with no direct confidentiality or availability loss. Publicly available exploit code exists, and the vendor has released a patched version (1.19).
The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insecure direct object reference in the Clean Login WordPress plugin versions 1.15 and earlier allows remote unauthenticated attackers to manipulate object identifiers to modify data they should not control and to disrupt plugin-managed functionality. The flaw is reported by Patchstack and tagged as an authentication bypass affecting Alberto Hornero's Clean Login plugin, with no public exploit identified at time of analysis. CVSS 3.1 rates it 8.2 due to the network-reachable, no-privileges, no-interaction vector with limited integrity impact and high availability impact.
Missing authorization in the Clean Login plugin for WordPress through version 1.20.1 allows any authenticated user with Contributor-level access or higher to hijack the plugin's front-end page mapping: the save_post-hooked CleanLogin_Shortcode::get_pages_with_shortcodes() routine runs without a current_user_can() check, so a Contributor who embeds the plugin's shortcodes in a post they authored can have the plugin's cl_login_url, cl_register_url, cl_restore_url, cl_edit_url and cl_change_password_url options (plus their matching ID values) overwritten with the ID and permalink of that attacker-owned post. Impact is limited to integrity of those plugin settings - no confidentiality or availability effect and no code execution - and exploitation is impossible without a valid low-privilege account on a site running the plugin. There is no CISA KEV entry and no public exploit identified at time of analysis; the overall priority is medium-to-low, with the practical risk concentrated on sites that hand Contributor accounts to untrusted users.
Bypass of the registration CAPTCHA in the WordPress Clean Login plugin before 1.19 allows unauthenticated attackers to create accounts without solving the challenge when the stored session value is empty. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) was reported, and our independent assessment rates this as a genuine low-to-moderate priority issue because the impact is limited to spam and automation abuse rather than compromise of existing accounts or the server. The vendor has released version 1.19 as the fixed release.
The Clean Login WordPress plugin before 1.19 lets unauthenticated attackers create user accounts on sites where registration is disabled, bypassing an administrative control intended to prevent open sign-ups. The registration handler fails to check the site's registration-enabled setting, so even locked-down sites become vulnerable; impact is limited to unauthorized low-privilege account creation (CVSS I:L) with no direct confidentiality or availability loss. Publicly available exploit code exists, and the vendor has released a patched version (1.19).
The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.