Description
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Clearfy Cache | < 2.4.3 | 2.4.3 |
References
- https://wpscan.com/vulnerability/3daf62cd-eefe-49ec-89f7-b13f88111853/ exploit vdb-entry technical-description