CVE-2026-16295

Name of the Vulnerable Software and Affected Versions Clearfy Cache WordPress plugin versions prior to 2.4.3

Description An issue exists where the plugin fails to perform a capability check in one of its admin-page dispatch paths. This allows any authenticated user, including those with Subscriber level permissions, to render settings pages intended only for administrators. Consequently, sensitive information, such as administrative nonces (unique tokens used to prevent cross-site request forgery), can be disclosed, even though the canonical page URL maintains the correct access restrictions.

Recommendations Update the plugin to version 2.4.3 or later.