CVE-2024-13338: Clearfy WordPress Plugin CSRF Vulnerability

CVE-2024-13338 Overview

CVE-2024-13338 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Clearfy Cache WordPress plugin. The flaw exists in all versions up to and including 2.3.1. It stems from missing or incorrect nonce validation on the wclearfy_cache_delete functionality. An unauthenticated attacker can clear the site cache by tricking an authenticated administrator into clicking a crafted link. The vulnerability affects the plugin's cache management component and requires user interaction to succeed.

Critical Impact
Unauthenticated attackers can invalidate WordPress site cache by luring administrators into visiting a malicious link, degrading site performance and originating unnecessary backend load.

Affected Products

Clearfy Cache WordPress plugin — all versions through 2.3.1
Vendor: cm-wp
CPE: cpe:2.3:a:cm-wp:clearfy:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2025-04-12 - CVE-2024-13338 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13338

Vulnerability Analysis

The Clearfy Cache plugin exposes a wclearfy_cache_delete action responsible for purging cached content. The handler does not validate a WordPress nonce or verify the request origin before executing the cache deletion. As a result, any request that reaches an authenticated administrator's browser can trigger the cache purge, regardless of whether the request originated from the WordPress admin interface.

Attackers exploit this by hosting a page that issues an automatic request to the vulnerable endpoint. When a logged-in administrator visits the page, the browser attaches the WordPress session cookies, and the request executes with administrator privileges. The impact is limited to integrity: repeated cache flushes force the server to regenerate content, which can degrade performance and increase origin load.

See the Wordfence Vulnerability Report for additional technical context.

Root Cause

The root cause is missing CSRF protection in the cache deletion handler. WordPress provides wp_verify_nonce() and check_admin_referer() helpers for validating admin-originated requests. The vulnerable code path invokes cache-clearing logic without calling either function, allowing forged requests to reach the sensitive action.

Attack Vector

Exploitation requires network access to the target site and user interaction from a privileged user. An attacker crafts a URL or HTML page containing an automatic request to the vulnerable action. Delivery typically occurs through phishing email, forum posts, or comment fields that reach a site administrator. No authentication is required from the attacker.

The vulnerability is described in prose only; no verified proof-of-concept code is publicly indexed. Refer to the vendor changeset for the applied fix.

Detection Methods for CVE-2024-13338

Indicators of Compromise

Unexpected HTTP GET or POST requests to WordPress admin endpoints containing the wclearfy_cache_delete parameter or action name.
HTTP Referer headers pointing to external or unknown domains preceding cache-clear actions.
Sudden spikes in origin server load or cache-miss ratios not correlated with legitimate administrator activity.

Detection Strategies

Inspect web server access logs for administrator sessions issuing cache-delete requests with off-site referers.
Correlate WordPress audit logs with browser activity timelines to identify cache purges triggered outside the admin dashboard.
Deploy a Web Application Firewall (WAF) rule to flag requests targeting the Clearfy cache endpoint without a valid nonce parameter.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record cache management events and the initiating user context.
Monitor cache hit/miss ratios and alert on abnormal invalidation frequency.
Review outbound links delivered to administrators through email and support channels for suspicious query parameters.

How to Mitigate CVE-2024-13338

Immediate Actions Required

Update the Clearfy Cache plugin to the version released in changeset 3268278 or later.
Audit administrator accounts and enforce phishing-resistant session hygiene, including logout from the admin panel when not in use.
Review site activity logs for evidence of unauthorized cache purges since the plugin was installed.

Patch Information

The vendor released a fix in the plugin's cache component. The patch adds nonce validation to the wclearfy_cache_delete handler, ensuring only requests originating from the WordPress admin interface can trigger the action. Details are available in the WordPress plugin changeset.

Workarounds

Restrict access to the WordPress admin area by IP allowlist at the web server or WAF layer.
Require administrators to use browser profiles isolated from general browsing when accessing WordPress admin.
Deploy a CSRF-protection WAF rule that blocks requests to the vulnerable endpoint lacking a valid nonce.

bash

# Example nginx rule to block cache-delete requests missing a nonce parameter
location /wp-admin/ {
    if ($arg_action = "wclearfy_cache_delete") {
        if ($arg__wpnonce = "") { return 403; }
    }
}