CVE-2026-16295 in Clearfy Cache Plugin

Riassunto

di MITRE • 04/08/2026

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsabile: WPScan
• Prenotare: 20/07/2026
• Divulgazione: 04/08/2026
• Moderazione: accettato
• Voce: VDB-385751
• CPE: pronto
• CWE: CWE-284 (confermato)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: molto basso
• Settore: Hostingprovider

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-16295
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16295
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-16295/