Clearfy Cache WordPress Plugin Authenticated Admin Page Disclosure

Executive Summary

This vulnerability is in the Clearfy Cache WordPress plugin before version 2.4.3. It allows any authenticated user, even those with low privileges like a Subscriber, to access admin-only settings pages. This happens because the plugin fails to check user capabilities before rendering these pages. As a result, sensitive information such as administrative nonces can be disclosed.

Useful 0 Not Useful 0

Detection Guidance

Check if the Clearfy Cache plugin version is below 2.4.3. Inspect WordPress admin pages for unauthorized access or disclosure of admin-only settings by authenticated users like Subscribers.

Useful 0 Not Useful 0

Impact Analysis

If you use the Clearfy Cache plugin before version 2.4.3, an attacker with a basic user account could access restricted admin settings. This may expose sensitive data like nonces, which could be used for further attacks. It undermines the security of your WordPress site by allowing unauthorized access to administrative functions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated users to access admin-only settings pages and disclose administrative nonces, which could lead to unauthorized changes or data exposure. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized access to sensitive settings or information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Clearfy Cache plugin to version 2.4.3 or later. Review user roles and permissions to ensure only authorized users can access admin settings.

Useful 0 Not Useful 0