CVE-2026-16296

The Clearfy Cache WordPress plugin (versions before 2.4.3 ) is vulnerable to an Open Redirect due to insufficient validation in its Cyrlitera old-URL redirect handler . The component passes a decoded request URI to an unsafe redirect function, enabling unauthenticated attackers to redirect visito...

CVE-2026-16296 Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...