CVE-2026-16295CWE-284broken-access-control

CVE-2026-16295

Medium · published August 4, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-04T11:16Z
References (1)
https://wpscan.com/vulnerability/ed3e613e-4bb8-45a7-8cfa-4a73aad9abc6/ · [email protected]
EPSS history
Timeline
  • 04 AUG 06:00Z
    Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher
    cvelistv5