4.7
Medium
CVE-2026-16296 The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect…
Description
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Clearfy Cache 2.4 | earliest → < 2.4.3 | 2.4.3 |
Other CVEs of Clearfy Cache
The 4 CVEs of Clearfy Cache →
CVE-2026-16295
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch…
4.3
Medium
CVE-2026-16297
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing…
4.1
Medium
CVE-2026-3220
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress…
8.8
High