EUVD-2026-52597
GHSA-rxcc-hfjf-j3mp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable plugin path; PR:L because any authenticated subscriber can trigger it; C:L for nonce and settings disclosure only; no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
AnalysisAI
Clearfy Cache WordPress plugin versions before 2.4.3 exposes admin-only settings pages and their contents - including administrative nonces - to any authenticated user at Subscriber level or above due to a missing capability check on an alternate admin-page dispatch path. While the canonical admin URL enforces access controls correctly, the unguarded dispatch path bypasses those restrictions entirely. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation probability despite POC availability; no confirmed active exploitation (CISA KEV) has been recorded.
Technical ContextAI
The vulnerability stems from CWE-284 (Improper Access Control), specifically a missing WordPress capability check (e.g., current_user_can()) in one of the plugin's admin-page dispatch routes. WordPress plugins typically register admin pages via add_menu_page() or add_submenu_page() and rely on both the registered capability parameter and explicit in-handler capability checks. Clearfy Cache correctly restricts access via the canonical page URL, but a secondary dispatch path - likely a custom action handler or alternative routing mechanism - omits this check. The affected CPE is cpe:2.3:a:unknown:clearfy_cache:*:*:*:*:*:*:*:* covering all versions below 2.4.3. Admin nonces in WordPress are short-lived cryptographic tokens tied to specific actions; their exposure to low-privilege users could facilitate secondary CSRF-bypassing attacks against protected admin operations.
RemediationAI
Upgrade Clearfy Cache to version 2.4.3 or later, which is the vendor-released patch per WPScan and EUVD-2026-52597 advisory data. The patch can be applied directly through the WordPress plugin dashboard or downloaded from the WordPress plugin repository. If immediate upgrade is not feasible, a compensating control is to disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent external parties from obtaining the Subscriber role needed to trigger this path - note this does not protect against existing low-privilege accounts. Alternatively, a WAF rule blocking requests to the unguarded dispatch path parameter can suppress exploitation, though the specific parameter name is not published in available data and would require plugin source review to implement precisely. Review existing Subscriber-level accounts for suspicious activity, particularly any that may have accessed admin-scoped endpoints. Advisory references: https://wpscan.com/vulnerability/ed3e613e-4bb8-45a7-8cfa-4a73aad9abc6/ and https://nvd.nist.gov/vuln/detail/CVE-2026-16295.
More in Clearfy Cache
View allUnauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and S
Open redirect in Clearfy Cache WordPress plugin (versions before 2.4.3) allows unauthenticated attackers to redirect sit
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today