WordPress Plugin Vulnerabilities

Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

Description

The plugin does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.

Proof of Concept

Affects Plugins

Plugin icon
clean-login
Fixed in 1.19

References

CVE
CVE-2026-90977

Miscellaneous

Original Researcher
Arthur Morgan
Submitter
Arthur Morgan
Verified
Yes
WPVDB ID
368db83e-ed7b-4f67-99db-2e5f1c01568e

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2022-11-29
Title
Appointment Hour Booking < 1.3.73 - CAPTCHA Bypass
Published
2022-08-22
Title
Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass
Published
2026-09-16
Title
WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters
Published
2022-04-13
Title
RSFirewall < 1.1.25 - IP Block Bypass
Published
2026-08-17
Title
Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email