CVE-2024-8252 is a high severity (CVSS 8.8) local file inclusion in the Clean Login plugin for WordPress, versions up to 1.14.5. A contributor account can include and run files through a shortcode attribute. The plugin changelog points to 1.14.6 as the fix.
What's affected
The record lists all versions of Clean Login up to and including 1.14.5. The vulnerable input is the template attribute of the clean-login-register shortcode. Contributor level users and above can set shortcode attributes in posts they write, which is why the account requirement is so low.
The plugin's changelog on WordPress.org has an entry for 1.14.6 reading "Sanitized file templates variables". That matches the described problem, and the record's references include a change set against the 1.14.5 code. The entry does not mention the CVE by name, so verify with the Wordfence advisory in the record's references if you need a formal statement.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The record also lists CWE-98, improper control of filename for include, and CWE-829, inclusion of functionality from an untrusted control sphere. It is not in CISA's KEV list.
How to check if you're exposed
On a server with WP-CLI:
wp plugin get clean-login --field=version
Anything at 1.14.5 or lower is affected. Then find out who on your site can author content:
wp user list --role=contributor --fields=ID,user_login
Also search post content for the shortcode with a template attribute you did not add yourself.
What to do now
- Update Clean Login to the latest release. The changelog shows 1.14.6 as the first fixed one, and later versions exist.
- Audit existing posts and drafts for
clean-login-registershortcodes that carry a template attribute. - Remove contributor and author accounts that are no longer needed, and review how people get those roles.
- Block PHP execution in the uploads directory. The record notes that exploitation gets easier where images or other safe file types can be uploaded and then included.
- Rotate secrets stored in wp-config if you find evidence that someone abused this.
Why it matters
File inclusion bugs turn a string into a path. If a plugin builds a file path from user supplied text and passes it to an include, an attacker picks what the server loads. The risk grows if any file the attacker can place on disk contains PHP, which is why upload handling and include handling must be reviewed together.
The shortcode route is easy to overlook. People tend to think of shortcodes as content, not input to a code path. Treat any attribute that selects a template or file as untrusted. Reachability analysis helps here: it tells you whether your site actually calls the vulnerable code, which narrows a long plugin list to the few that matter.
Quick check
Does a visitor need to log in to exploit this?
Yes. The record requires contributor level access or higher, though many sites hand that role out freely.
What is the safest first step?
Update the plugin, then audit posts that use the registration shortcode with a template attribute.
Sources
Last reviewed: 19 October 2026.
