CVE-2026-16297

Name of the Vulnerable Software and Affected Versions Clearfy Cache WordPress plugin versions prior to 2.4.3

Description Users with administrator access can perform PHP Object Injection attacks because the plugin does not restrict the classes allowed when unserializing settings-import data. This may lead to remote code execution if a suitable gadget chain is present in the environment. PHP Object Injection is a vulnerability that occurs when untrusted input is passed to the unserialize() function, allowing an attacker to manipulate the object's properties or trigger unexpected code execution.

Recommendations Update the plugin to version 2.4.3 or later.