CVE-2026-116610 Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes function hooked to the savepost action. This makes it possible for authenticated attackers, wit...

EUVD-2026-111597

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes function hooked to the savepost action. This makes it possible for authenticated attackers, wit...

CVE-2026-116610

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.20.1 . The root cause is a missing capability check in the CleanLogin_Shortcode::get_pages_with_shortcodes() function, which is hooked to the save_post action. This allows authenticated a...