CVE-2026-116610

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin Shortcode::get pages with shortcodes() function hooked to the save post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl login url/cl login id/cl register url/cl register id/cl restore url/cl restore id/cl edit url/cl edit id/cl change password url/cl change password id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.