The Clearfy Cache – WordPress optimization plugin, which provides features like minifying HTML, CSS, and JS, is vulnerable to CSRF due to the absence of nonce validation on the "wbcr_upm_change_flag" function. This flaw enables unauthenticated attackers to send forged requests that can disable update notifications if an administrator is tricked into clicking a malicious link. The vulnerability affects all versions up to and including 2.4.0. The CVSS 3.1 base score is 4.3, indicating a medium severity level with network attack vector, low complexity, no privileges required, but requiring user interaction. The impact is limited to integrity (disabling update notifications) without confidentiality or availability impact.

An attacker can cause an administrator to unknowingly disable plugin or theme update notifications, potentially increasing the risk of missing important security updates. There is no direct confidentiality or availability impact. The vulnerability requires user interaction and does not grant the attacker direct control over the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.