CVE-2026-90977 Overview
The Clean Login WordPress plugin before version 1.19 contains a CAPTCHA validation flaw on its registration form. The plugin fails to verify the registration CAPTCHA when the stored session value is empty. Unauthenticated attackers can bypass the anti-automation control and create accounts without solving the challenge. The issue is tracked under [CWE-697] (Incorrect Comparison) and enables automated account creation at scale.
Critical Impact
Unauthenticated attackers can bypass CAPTCHA validation on the registration form, enabling automated account creation, spam campaigns, and downstream abuse of registered user privileges.
Affected Products
- Clean Login WordPress plugin versions prior to 1.19
- WordPress sites with Clean Login registration enabled
- Any deployment relying on the plugin's built-in CAPTCHA as anti-automation control
Discovery Timeline
- 2026-09-18 - CVE CVE-2026-90977 published to the National Vulnerability Database (NVD)
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-90977
Vulnerability Analysis
The vulnerability resides in the CAPTCHA verification logic used by the Clean Login registration workflow. The plugin compares a user-submitted CAPTCHA response against a value stored in the session. When the stored session value is empty, the comparison logic treats the submission as valid rather than rejecting the request. Attackers who never trigger CAPTCHA generation, or who craft requests that skip session initialization, can submit the registration form directly without solving any challenge.
The flaw is classified as an Incorrect Comparison weakness [CWE-697]. The plugin's control assumes that a session-backed CAPTCHA value always exists before verification runs. That assumption breaks under normal request manipulation, converting the CAPTCHA from a gating control into an optional one.
Root Cause
The root cause is missing validation of the CAPTCHA session state prior to comparison. Secure implementations must treat an empty or unset expected value as a verification failure. The plugin's logic instead permits the comparison to succeed, effectively defaulting to allow when the session variable is absent.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker sends crafted POST requests to the Clean Login registration endpoint without first requesting the CAPTCHA image or initializing the session variable. Because the stored CAPTCHA value remains empty, verification passes and the account is created. The attack is trivial to automate with any HTTP client.
No verified exploit code has been published. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-90977
Indicators of Compromise
- Sudden spikes in new user registrations from the Clean Login plugin, especially from a narrow set of IPs or user agents
- Registration POST requests to the plugin's endpoint without prior GET requests to the CAPTCHA image handler
- Newly created accounts with formulaic usernames, disposable email domains, or sequential registration timestamps
Detection Strategies
- Correlate WordPress wp_users table inserts with web access logs to identify registrations lacking a preceding CAPTCHA fetch
- Inspect HTTP request patterns for missing or empty CAPTCHA parameters submitted to the registration handler
- Deploy web application firewall (WAF) rules that flag registration requests missing expected session cookies
Monitoring Recommendations
- Alert on registration volume anomalies exceeding baseline thresholds per hour or per source IP
- Monitor the Referer and session cookie headers on registration submissions for consistency with legitimate browser flows
- Ingest WordPress and web server logs into a centralized analytics platform to enable cross-source correlation of automated registration activity
How to Mitigate CVE-2026-90977
Immediate Actions Required
- Upgrade the Clean Login WordPress plugin to version 1.19 or later
- Audit accounts created since the plugin was installed and disable any suspicious registrations
- Enable an external CAPTCHA or bot-mitigation service in front of the registration form until patching completes
Patch Information
The vendor addressed the issue in Clean Login version 1.19. The fix ensures that an empty stored CAPTCHA value is treated as a verification failure rather than a match. Administrators should update through the WordPress plugin manager or download the patched release directly. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily disable public registration through Clean Login until the plugin is updated
- Place the registration endpoint behind a WAF rule that requires a valid session cookie and non-empty CAPTCHA parameter
- Require administrator approval for all new accounts to contain the impact of automated registrations
# Update the Clean Login plugin via WP-CLI
wp plugin update clean-login --version=1.19
# Verify installed version
wp plugin get clean-login --field=version
# Temporarily disable public registration site-wide
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.