Clearfy < 2.4.3 – Open Redirect via Cyrlitera 404 Handler | CVE 2026-16296

Description

The plugin does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.

Proof of Concept

Prerequisites (admin, one-time, non-default): pretty permalinks enabled; the Cyrlitera / Transliteration component active (default on); the "Redirection old URLs to new ones" option enabled at Settings > Clearfy > SEO > Transliteration (OFF by default). No authentication is needed to trigger the redirect.

Send an anonymous request whose path is a double-encoded protocol-relative URL to an attacker host:
curl -s -i "https://victim.example/%252Fevil.com"
=> HTTP 301
   Location: //evil.com
   X-Redirect-By: WordPress

A single-encoded slash with a case or path delta (to pass the plugin's current_url != new_url guard) also works:
curl -s -i "https://victim.example/%2Fattacker.example/Foo?bar=baz"
=> HTTP 301, Location: //attacker.example/foo?bar=baz  (query string preserved)

Negative controls: an all-lowercase host with no path does not differ after transliteration and returns 404 (no redirect); with the option disabled the request returns 404.