PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-90976 Clean Login CVE debrief

CVE-2026-90976 allows unauthenticated users to create accounts on WordPress sites using the Clean Login plugin, even when user registration is disabled. This issue arises from the plugin's registration handler failing to check if user registration is enabled before creating an account. The Clean Login WordPress plugin before version 1.19 does not check if user registration is enabled before creating an account in its registration handler. This allows unauthenticated users to create accounts even when the site has registration disabled. Defenders should verify their site's exposure, review registration settings, and monitor for unauthorized account creation attempts. The CVE record,

Vendor
Clean Login
Product
Clean Login WordPress plugin
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-18
Original CVE updated
2026-09-18
Advisory published
2026-09-18
Advisory updated
2026-09-18

Who should care

WordPress site administrators using the Clean Login plugin should assess their exposure and verify if they are using a vulnerable version. They should also review their site's user registration settings and monitor for any unauthorized account creation attempts.

Why it matters

CVE-2026-90976 allows unauthenticated users to create accounts on WordPress sites using the Clean Login plugin, even when user registration is disabled. Defenders should verify their site's exposure, review registration settings, and monitor for unauthorized account creation attempts.

  • Defenders need to verify if their WordPress sites use the Clean Login plugin and ensure it is updated.
  • Site administrators must review user registration settings to prevent unauthorized account creation.
  • Monitoring for suspicious account creation attempts is necessary.

Technical summary

The Clean Login WordPress plugin before version 1.19 does not check if user registration is enabled before creating an account in its registration handler. This allows unauthenticated users to create accounts even when the site has registration disabled.

Defensive priority

Defenders should prioritize verifying if their WordPress sites use the Clean Login plugin and ensure it is updated to version 1.19 or later. They should also review their site's user registration settings and monitor for any unauthorized account creation attempts.

Recommended defensive actions

  • Verify if the Clean Login plugin is installed and update to version 1.19 or later if necessary.
  • Review WordPress site user registration settings to prevent unauthorized account creation.
  • Monitor for suspicious account creation attempts.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. WPScan also reported this issue. However, there is limited information on exploitation or affected versions beyond the Clean Login plugin before version 1.19.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-90976 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-90976

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-90976 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90976

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.