CVE-2026-16297 — Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import

CVE-2026-16297

Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import PUBLISHED

Description (CNA)

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.

Affected (CNA)

Vendor / product	Versions
Unknown / Clearfy Cache	affected 0 before 2.4.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/3daf62cd-eefe-49ec-89f7-b13f88111853/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.