high·Exposed Panels·Updated Apr 9, 2026

WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

2.8k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2024-8252

8.8

CVSShigh

Exploitable remotely over the internet · low-privilege account sufficient.

The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Attack Vector

Network

Privileges Req.

Low

User Interaction

None

Affected

Clean Loginby hornero

clean_loginby codection

Updated Sep 9, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion

Check your infrastructure.Right now.

Check your infrastructure.
Right now.