WordPress Plugin Vulnerabilities

Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled

Description

The plugin does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.

Proof of Concept

Affects Plugins

Plugin icon
clean-login
Fixed in 1.19

References

CVE
CVE-2026-90976

Miscellaneous

Original Researcher
Artus KG
Submitter
Artus KG
Submitter twitter
artuskg
Verified
Yes
WPVDB ID
e72f9529-6500-4ed2-a8cc-d77045b6be5c

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2026-09-01
Title
WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
Published
2022-05-17
Title
iQ Block Country < 1.2.29 - Protection Bypass due to IP Spoofing
Published
2022-10-28
Title
Login Block IPs <= 1.0.0 - IP Spoofing Bypass
Published
2019-09-21
Title
DELUCKS SEO <= 2.1.7 - Unauthenticated Options Update
Published
2014-09-22
Title
Wordfence 5.2.3 - Banned IP Functionality Bypass