4.3
Medium
CVE-2026-16295 The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch…
Description
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Clearfy Cache 2.4 | earliest → < 2.4.3 | 2.4.3 |
Other CVEs of Clearfy Cache
The 4 CVEs of Clearfy Cache →
CVE-2026-16296
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect…
4.7
Medium
CVE-2026-16297
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing…
4.1
Medium
CVE-2026-3220
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress…
8.8
High