# CVE-2026-116610: Clean Login WordPress plugin authorization bypass in shortcode handler

Source: https://junglewise.ai/threats/cve-2026-116610-the-clean-login-plugin-for-wordpress-is-vulnerable-to-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116610 · Severity: medium · CVSS 4.3 · Published 2026-10-28

Clean Login is a WordPress plugin that manages user login and registration pages. The plugin fails to properly verify user permissions before allowing authenticated users to modify critical plugin settings, allowing a Contributor-level user to redirect login and registration pages to their own content by embedding shortcodes in posts they author. This could redirect legitimate users to attacker-controlled pages for credential theft or phishing.

Vendors: [WordPress.org](https://junglewise.ai/threats/vendors/wordpress-org).

## Quick answers

**Is CVE-2026-116610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116610 being exploited in the wild.

**How severe is CVE-2026-116610?** Medium severity, with a CVSS score of 4.3, published 28 October 2026.

**Which products and versions are affected?** WordPress.org Clean Login up to 1.20.1.

**Is there a fix for CVE-2026-116610?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116610 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116610?** Check whether you run WordPress.org Clean Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CleanLogin_Shortcode::get_pages_with_shortcodes() function, hooked to the save_post action, lacks a capability check and allows authenticated Contributor-level users to overwrite plugin options (cl_login_url, cl_register_url, cl_restore_url, cl_edit_url, cl_change_password_url and their corresponding IDs) with post data they control. An attacker with Contributor role can trigger this by embedding plugin shortcodes in their own posts, causing the plugin to store their post ID and permalink as the canonical login/registration endpoints.

## Affected products

- WordPress.org Clean Login up to 1.20.1

## Timeline

- 2026-10-28: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php](https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php)
- [https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php](https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php)