CVE-2026-90976

Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.

Affected

Clean Login

CVSS v3.1 WPSCAN

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 22nd percentile

Published

2026-09-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e72f9529-6500-4ed2-a8cc-d77045b6be5c/

References

• CVE Record
• NVD entry