{"id":"CVE-2026-116610","aliases":[],"title":"Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook","titleSource":"Wordfence","descriptionSource":"Wordfence","products":[{"vendor":"hornero","name":"Clean Login","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.20.1","versionType":"semver"}],"defaultStatus":"unaffected","source":"Wordfence","url":"https://www.cve.org/CVERecord?id=CVE-2026-116610"}],"remediation":[],"description":"The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.","severity":"medium","score":4.3,"published":"2026-10-28T06:45:15.107Z","modified":"2026-10-28T16:09:40.610Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/83a8c282-8552-420d-842f-acd235ad61b8?source=cve","https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php#L262","https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php#L14","https://plugins.trac.wordpress.org/changeset/3768058/clean-login","https://plugins.trac.wordpress.org/changeset/3768058/clean-login/trunk/include/shortcodes.php"],"sources":[{"name":"CVE","id":"CVE-2026-116610","modified":"2026-10-28T16:09:40.610Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116610"}],"assessments":[{"source":"Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:25:32.145Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T09:40:36.504Z","attemptedAt":"2026-10-28T09:40:36.504Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T09:40:36.465Z","attemptedAt":"2026-10-28T09:40:36.465Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T09:40:35.542Z","attemptedAt":"2026-10-28T09:40:35.542Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T09:40:35.319Z","attemptedAt":"2026-10-28T09:40:35.319Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-111597","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111597","modified":"Oct 28, 2026, 6:45:15 AM","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-28T09:40:35.542Z"},{"source":"GitHub Advisory Database","id":"GHSA-v79r-g77x-46wf","url":"https://github.com/advisories/GHSA-v79r-g77x-46wf","modified":"2026-10-28T09:32:03Z","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-28T09:40:36.465Z"},{"source":"NVD","id":"CVE-2026-116610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116610","modified":"2026-10-28T07:16:47.450","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-28T09:40:36.504Z"}]}