CVE-2026-90977 — Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

CVE-2026-90977

Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison PUBLISHED

Description (CNA)

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.

Affected (CNA)

Vendor / product	Versions
Unknown / Clean Login	affected 0 before 1.19

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/368db83e-ed7b-4f67-99db-2e5f1c01568e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.