CVE-2026-16297
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The 'Clearfy Cache' WordPress plugin before version 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Risk Assessment
An administrator can be tricked into executing malicious code on the server, potentially leading to full site and server compromise.
Recommendation
Update the plugin to version 2.4.3 or later, which restricts allowed classes during unserialization.
Other vulnerabilities in Clearfy Cache
See all- CVE-2026-16296Medium
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
- CVE-2026-16295Medium
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
Original NVD description (English source)
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.