CVE-2026-16296 Overview
CVE-2026-16296 is an open redirect vulnerability in the Clearfy Cache WordPress plugin versions prior to 2.4.3. The plugin's Cyrlitera old-URL redirect handler fails to validate the redirect target before passing a decoded request URI to an unsafe redirect function. Unauthenticated attackers can craft URLs that redirect visitors to arbitrary external destinations when a non-default plugin option is enabled. The flaw is classified as [CWE-601] URL Redirection to Untrusted Site.
Critical Impact
Attackers can leverage the trusted domain of a WordPress site to redirect users to phishing pages or malware distribution sites, enabling social engineering and credential theft campaigns.
Affected Products
- Clearfy Cache WordPress plugin versions prior to 2.4.3
- WordPress sites with the Cyrlitera old-URL redirect option enabled
- Deployments exposing the plugin's redirect handler to unauthenticated network traffic
Discovery Timeline
- 2026-08-04 - CVE-2026-16296 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-16296
Vulnerability Analysis
The Clearfy Cache plugin implements a Cyrlitera compatibility feature that redirects visitors from old URL formats to updated destinations. The redirect handler accepts a request URI from the incoming HTTP request, decodes it, and passes the decoded string directly to a redirect function without validating that the target belongs to the site's own domain. This lack of validation allows the redirect target to be manipulated through crafted URL parameters.
Open redirect flaws such as this one are commonly abused in phishing campaigns because the initial link points to a legitimate, trusted domain before the browser is silently forwarded to an attacker-controlled host. User interaction is required to trigger the redirect, and the vulnerability only manifests when a non-default plugin option is enabled.
Root Cause
The root cause is missing destination validation in the Cyrlitera old-URL redirect handler. The handler treats the decoded request URI as trusted input and forwards it to an unsafe redirect function that does not enforce a same-origin or allow-list check. Without host validation, absolute URLs pointing to external domains are accepted as valid redirect targets.
Attack Vector
An unauthenticated attacker crafts a URL on the vulnerable WordPress site that embeds an external destination in the request URI processed by the Cyrlitera handler. The attacker distributes this URL through email, messaging platforms, or malicious ads. When a visitor clicks the link, the WordPress site returns a redirect response that sends the browser to the attacker-controlled site. Technical details are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-16296
Indicators of Compromise
- HTTP 301 or 302 responses from the WordPress site with Location headers pointing to external domains not owned by the site operator
- Access log entries containing encoded external URLs in the request URI processed by the Cyrlitera handler
- Referrer telemetry from third-party sites showing traffic originating from unexpected paths on the WordPress domain
Detection Strategies
- Inspect web server access logs for requests where the decoded URI contains fully qualified external URLs or protocol schemes such as http:// and https://
- Correlate outbound redirect responses with the plugin's redirect handler paths to identify anomalous destination hosts
- Deploy web application firewall rules that flag requests carrying external URL patterns in parameters bound for the plugin
Monitoring Recommendations
- Monitor for spikes in redirect responses from the WordPress instance that resolve to newly registered or low-reputation domains
- Alert on user reports of unexpected redirects originating from links to the WordPress site
- Track plugin version inventory across WordPress deployments to identify installations below version 2.4.3
How to Mitigate CVE-2026-16296
Immediate Actions Required
- Upgrade the Clearfy Cache plugin to version 2.4.3 or later on every affected WordPress site
- Audit the plugin configuration and disable the Cyrlitera old-URL redirect option if the feature is not required
- Review recent web logs for evidence of open redirect abuse and notify users who may have followed malicious links
Patch Information
The vendor addressed the vulnerability in Clearfy Cache version 2.4.3 by adding validation to the Cyrlitera redirect handler. Site administrators should apply the update through the WordPress plugin management interface or by replacing the plugin files with the patched release. Refer to the WPScan Vulnerability Report for release details.
Workarounds
- Disable the Cyrlitera old-URL redirect option until the plugin is updated to 2.4.3 or later
- Deactivate the Clearfy Cache plugin entirely on sites that do not rely on its caching features
- Configure a web application firewall rule to reject requests where the request URI contains external URL schemes destined for the plugin handler
# Configuration example
# Update Clearfy Cache to the patched version via WP-CLI
wp plugin update clearfy --version=2.4.3
wp plugin get clearfy --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
