Executive brief
The Clearfy Cache WordPress plugin is widely used to improve website performance and SEO. Versions before 2.4.3 contain an open redirect vulnerability in its URL transliteration feature that allows attackers to send malicious links to website visitors, redirecting them to attacker-controlled external websites. This can be exploited without authentication if a non-default option is enabled, potentially compromising user trust and enabling phishing or malware distribution attacks.
Technical details
The vulnerability is an open redirect (CWE-601) in the Cyrlitera old-URL redirect handler that fails to validate redirect targets before passing them to an unsafe redirect function. An unauthenticated attacker can craft a malicious URL containing a double-encoded protocol-relative URL (e.g., %252F//evil.com) or single-encoded paths that exploit the transliteration logic to bypass the plugin's current_url != new_url guard. The vulnerability requires two non-default preconditions: pretty permalinks enabled and the "Redirection old URLs to new ones" option activated in Settings > Clearfy > SEO > Transliteration. Exploitation results in HTTP 301/302 redirects to arbitrary external URLs, potentially used for credential theft, phishing, or malware delivery. The vulnerability is fixed in version 2.4.3.
Affected products
- Clearfy Clearfy Cache before 2.4.3
Timeline
- 2026-07-27: disclosed
- 2026-07-27: patched: Fixed in version 2.4.3
- 2026-08-04: advisory