CVE-2026-90976 Overview
CVE-2026-90976 affects the Clean Login WordPress plugin in versions prior to 1.19. The plugin fails to verify whether user registration is enabled before creating a new account through its registration handler. Unauthenticated attackers can create accounts on sites that have explicitly disabled registration. The flaw is a broken access control issue [CWE-284] that undermines an administrator's intended site policy. Site owners who disabled registration to prevent spam, account enumeration, or downstream exploitation lose that protection while the plugin is active.
Critical Impact
Unauthenticated remote attackers can create WordPress user accounts on affected sites regardless of the site's registration settings, bypassing an intended administrative control.
Affected Products
- Clean Login WordPress plugin versions prior to 1.19
- WordPress sites with the plugin active and registration disabled at the site level
- Any deployment relying on Clean Login's registration handler for access control
Discovery Timeline
- 2026-09-18 - CVE-2026-90976 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-90976
Vulnerability Analysis
The Clean Login plugin provides front-end login, registration, and profile-management shortcodes for WordPress. The registration handler processes incoming form submissions and creates a new WordPress user account when required fields validate. WordPress exposes a global site option, users_can_register, that administrators toggle to enable or disable open registration. The plugin's registration handler does not consult this option before creating the account. As a result, the plugin bypasses the site-wide policy that WordPress core enforces on its default registration flow. Refer to the WPScan Vulnerability Report for further technical context.
Root Cause
The root cause is a missing authorization check [CWE-284] in the plugin's registration endpoint. The handler assumes the caller reached the registration form legitimately and proceeds directly to account creation. It does not read get_option('users_can_register') or verify any equivalent plugin-level setting before invoking wp_insert_user or its wrappers. This is a business-logic gap rather than an input-validation flaw.
Attack Vector
An unauthenticated attacker submits a crafted HTTP POST request to the plugin's registration endpoint with the required fields (typically username, email, and password). The plugin creates the account with the default WordPress role, usually subscriber. The attacker can repeat the request to enumerate usernames, pollute the user database, or stage follow-on attacks such as privilege escalation through other vulnerable plugins or password-reset abuse. No credentials, tokens, or user interaction are required.
No verified public proof-of-concept code is available at time of publication. See the WPScan Vulnerability Report for additional details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90976
Indicators of Compromise
- New WordPress user accounts created while users_can_register is set to 0 in the site options table
- Multiple user_register events in the WordPress audit log originating from unauthenticated sessions
- Spikes in POST requests to Clean Login registration shortcodes or endpoint URLs from a small set of source IPs
- Newly created accounts with sequential or randomized usernames and disposable-email domains
Detection Strategies
- Compare the WordPress users table against the users_can_register option and alert on any account created while registration was disabled
- Instrument the user_register action hook to log the request source, referrer, and originating IP for every new account
- Correlate web-server access logs with the plugin's registration endpoint to identify high-volume unauthenticated POST traffic
Monitoring Recommendations
- Enable audit logging for all user-creation events and forward them to a centralized SIEM or data lake
- Baseline the normal rate of account creation and alert on statistically significant deviations
- Monitor for password-reset requests immediately following account creation, which can indicate takeover chaining
How to Mitigate CVE-2026-90976
Immediate Actions Required
- Update the Clean Login plugin to version 1.19 or later on every affected WordPress site
- Audit the users table for accounts created after the plugin was installed and remove any unauthorized entries
- Force password resets on any account whose provenance cannot be verified
- Review connected plugins that grant elevated capabilities to subscriber-level accounts and restrict them
Patch Information
The vendor addressed the issue in Clean Login version 1.19 by adding a check for the site's registration setting before processing the registration request. Administrators should install the update through the WordPress plugin manager or via wp-cli using wp plugin update clean-login. See the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Deactivate the Clean Login plugin until the update to 1.19 or later can be applied
- Block the plugin's registration endpoint at the web application firewall or reverse proxy layer
- Restrict access to pages containing the Clean Login registration shortcode with IP allow-lists during the mitigation window
# Update Clean Login using wp-cli
wp plugin update clean-login --version=1.19
# Verify the site-level registration setting
wp option get users_can_register
# Audit recently created accounts
wp user list --fields=ID,user_login,user_email,user_registered --orderby=user_registered --order=DESC
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
