WordPress Plugin Vulnerabilities

Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import

Description

The plugin does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.

Proof of Concept

Affects Plugins

Plugin icon
clearfy
Fixed in 2.4.3

References

CVE
CVE-2026-16297

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Omar Elshopky
Submitter
Omar Elshopky
Submitter website
https://omarelshopky.com
Submitter twitter
3l5h0pky
Verified
Yes
WPVDB ID
3daf62cd-eefe-49ec-89f7-b13f88111853

Timeline

Publicly Published
2026-07-24 (about 11 days ago)
Added
2026-07-24 (about 10 days ago)
Last Updated
2026-07-24 (about 10 days ago)

Other

Published
Title
Published
2025-05-07
Title
WP-CRM System < 3.4.6 - Authenticated (Administrator+) PHP Object Injection
Published
2025-06-03
Title
PIMP - Creative MultiPurpose <= 1.7 - Unauthenticated PHP Object Injection
Published
2025-06-24
Title
VEDA <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
Published
2025-05-20
Title
DZS Video Gallery < 12.40 - Unauthenticated PHP Object Injection
Published
2025-01-16
Title
Quick Count <= 3.00 - Unauthenticated PHP Object Injection