The Clean Login plugin performs a missing capability check in the CleanLogin_Shortcode::get_pages_with_shortcodes() function, which is triggered by the save_post action. Because this check is absent, users who have Contributor or higher roles can insert the plugin's shortcodes into a post they author. Each time the post is saved, the plugin’s internal URLs for login, registration, restoration and password change are overwritten to point to the attacker’s post, effectively redirecting visitors to an attacker-controlled location. This allows a contributor to execute phishing or defacement attacks hidden behind legitimate plugin URLs, compromising user trust and potentially exposing sensitive user credentials. The flaw is a classic Missing Authorization (CWE‑862) vulnerability.

The vulnerability impacts the Clean Login WordPress plugin by hornero, affecting all released versions up to and including 1.20.1. Any WordPress site that has installed Clean Login 1.20.1 or any earlier snapshot is vulnerable.

The CVSS score is 4.3, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to already hold Contributor-level or higher privileges on the site, meaning the attack is limited to authenticated users with editing rights. While the attack vector is not remote network based, insiders or compromised contributor accounts can carry out the exploit, potentially leading to phishing or defacement of site content.