CVE-2026-90977

Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.

Affected

Clean Login

CVSS v3.1 WPSCAN

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2026-09-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/368db83e-ed7b-4f67-99db-2e5f1c01568e/

References

• CVE Record
• NVD entry