Clearfy Cyrlitera redirects accept arbitrary external destinations
Clearfy Cache before 2.4.3 decodes the request URI in its Cyrlitera old-URL redirect handler and passes the result to an unsafe redirect function without validating the destination. When the non-default old-URL redirect option is enabled, an unauthenticated attacker can construct a site URL that redirects visitors to an arbitrary external location. The public advisory does not disclose the handler, option name, URI encoding or redirect function.
- Component
- Clearfy Cache
- Plugin slug
clearfy-cache- Affected
- < 2.4.3
- Safe version
2.4.3- Published
- Aug 04, 2026
This CVE was published Aug 04, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update Clearfy Cache to 2.4.3 or later. Until updated, disable Cyrlitera's old-URL redirects and avoid distributing or following untrusted links that appear to target the affected site.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N