CVE-2026-16295: unknown clearfy cache Improper Access Control
Vulnerability summary
CVE-2026-16295 is a medium (CVSS 4.3) Improper Access Control vulnerability in unknown clearfy cache. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.9% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.4.3.
Timeline
- 04-08-2026PublishedVulnerability first disclosed.
- 04-08-2026Last modifiedVulnerability information updated.
Description
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
+0.11 pp
From 0.16% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Unknown1 product
- clearfy cache< 2.4.3
Wordpress1 product
- clearfy< 2.4.3
2 vendors · 2 products