CVE-2026-90976
Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
| Vendor | unknown |
| Product | clean login |
| Published | Sep 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown clean login
Be the first to know when new medium vulnerabilities affecting unknown clean login are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Clean Login
0 < 1.19
References
Credits
Artus KG WPScan