4.1
Medium
CVE-2026-16297 The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing…
Description
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Clearfy Cache 2.4 | earliest → < 2.4.3 | 2.4.3 |
Other CVEs of Clearfy Cache
The 4 CVEs of Clearfy Cache →
CVE-2026-16296
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect…
4.7
Medium
CVE-2026-16295
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch…
4.3
Medium
CVE-2026-3220
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress…
8.8
High