CVE-2026-16297CWE-502insecure-deserialization

CVE-2026-16297

Medium · published August 3, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-08-03T11:16Z
References (1)
https://wpscan.com/vulnerability/3daf62cd-eefe-49ec-89f7-b13f88111853/ · [email protected]
EPSS history
Timeline
  • 03 AUG 06:00Z
    Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import
    cvelistv5