CVE-2026-90977Medium· 5.3▾ TwilightPoC availableThe Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accoun…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Exploit / PoC code exists
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90976Medium· 5.3The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registratio…
CVE-2026-104198Medium· 5.3ZoneMinder is a free, open source closed-circuit television software application
CVE-2026-108969High· 7.3A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449
CVE-2026-101912Medium· 6.3ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-101913Medium· 6.3ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-75110Critical· 9.8MemOS is a memory operating system for LLMs and AI agents