# Clean Login <= 1.20.1 - Authenticated (Contributor+) Missing Authorization to Plugin Page Settings Update via Shortcode

- **ID:** WPSEC-2026-1820
- **Plugin:** Clean Login (`clean-login`), https://wordpress.org/plugins/clean-login/
- **Affected versions:** all versions before 1.21
- **Fixed in:** 1.21 (Update to 1.21 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/clean-login
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1820/

## Description

The Clean Login plugin for WordPress is vulnerable to unauthorized modification of data via the save_post handler that records the pages containing the plugin's shortcodes in all versions up to, and including, 1.20.1, due to a missing capability check in the get_pages_with_shortcodes() function. Saving any post, including an unpublished draft, that contains a Clean Login shortcode overwrites the site-wide login, edit, register, restore and change password page URLs and IDs. This makes it possible for authenticated attackers, with Contributor-level access and above, to point the plugin's links and redirects at a post they control, breaking the site's login, registration and password reset flows.

Also published later by wordfence as CVE-2026-116610.

## References

- https://wpsec.com/vuln/WPSEC-2026-1820/
- https://plugins.svn.wordpress.org/clean-login/tags/1.21/
- https://wordpress.org/plugins/clean-login/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1820/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.