Missing Authorization Flaw in Clean Login Plugin for WordPress

CVE-2026-116610

What is CVE-2026-116610?

The Clean Login plugin for WordPress has a vulnerability that allows authenticated users with Contributor-level access and higher to manipulate critical plugin settings. Due to a missing capability check in the get_pages_with_shortcodes() function, these users can overwrite options such as cl_login_url, cl_register_url, and others, by simply embedding the plugin's shortcodes in their own post content. This oversight exposes the plugin to potential abuse and security risks, warranting prompt attention and remediation.

References