4.1
Moyenne
CVE-2026-16297 The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing…
Description
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Clearfy Cache 2.4 | premières → < 2.4.3 | 2.4.3 |
Autres CVE de Clearfy Cache
Les 4 CVE de Clearfy Cache →
CVE-2026-16296
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect…
4.7
Moyenne
CVE-2026-16295
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch…
4.3
Moyenne
CVE-2026-3220
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress…
8.8
Élevée