CVE-2026-16295
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
Risk Assessment
The risk includes disclosure of sensitive administrative information that could be used for further attacks such as CSRF or privilege escalation.
Recommendation
Update the Clearfy Cache plugin to version 2.4.3 or later and ensure all admin paths have proper capability checks.
Other vulnerabilities in Clearfy Cache
See all- CVE-2026-16296Medium
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
- CVE-2026-16297Medium
The 'Clearfy Cache' WordPress plugin before version 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Original NVD description (English source)
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.