CVE-2026-16296: Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler
Published Aug 4, 2026
·Updated
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
Affected Software
1 affected component
WordPress plugin Clearfy Cache<2.4.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Clearfy Cache (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.4.3 - Compensating control
If the non-default option that enables the Cyrlitera old-URL redirect handler is not required, disable it until the Clearfy Cache plugin is upgraded to 2.4.3.
Event History
Aug 4, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness