The Clearfy Cache – WordPress optimization plugin (up to version 2.3.1) contains a CSRF vulnerability (CWE-352) due to improper nonce validation on the wclearfy_cache_delete function. This allows unauthenticated attackers to induce an authenticated administrator to perform cache clearing actions via crafted requests. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or manual mitigation.

An attacker can cause an authenticated administrator to clear the website cache without their intent, potentially leading to performance degradation or temporary disruption of cached content delivery. There is no direct impact on confidentiality or availability, but integrity is affected due to unauthorized cache clearing. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the vulnerable cache clearing functionality may reduce risk. Monitor vendor channels for official patches or updates.