CVE-2026-16297 — Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perfo…
Published: 2026-08-03 · CVSS: 4.1 · CVSS 3.1
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7