Is CVE-2026-16295 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-16295

Description

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.