WordPress Plugin Vulnerabilities

Clean Login < 1.16 - Unauthenticated Insecure Direct Object Reference

Description

The Clean Login plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
clean-login
Fixed in 1.16

References

CVE
CVE-2026-54184
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f36a960d-e8bd-47aa-b20a-8d91e678faba

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Jakub Herman
Verified
No
WPVDB ID
f235bcd1-8a85-475c-b5bc-fb16158c5457

Timeline

Publicly Published
2026-06-16 (about 4 months ago)
Added
2026-06-25 (about 3 months ago)
Last Updated
2026-06-25 (about 3 months ago)

Other

Published
Title
Published
2025-04-11
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.4 - Insecure Direct Object Reference to Unauthenticated Membership Modification
Published
2026-08-25
Title
ShopApper <= 0.4.69 - Subscriber+ Customer Data Disclosure via IDOR
Published
2026-01-02
Title
Roam <= 2.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-04-16
Title
Fluent Forms < 6.2.0 - Unauthenticated Payment Status Modification via IDOR
Published
2026-10-16
Title
Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR