The Clearfy Cache WordPress plugin before version 2.4.3 contains an open redirect vulnerability (CWE-601) in its Cyrlitera old-URL redirect handler. The plugin passes a decoded request URI to an unsafe redirect function without validating the redirect target. This flaw enables unauthenticated attackers to redirect visitors to arbitrary external URLs if a non-default option is enabled, potentially facilitating phishing or other social engineering attacks. There is no official remediation level or patch information provided in the available data.

The vulnerability allows unauthenticated attackers to redirect users to arbitrary external websites. This can be leveraged for phishing or redirecting users to malicious sites, potentially leading to user deception or loss of trust. The vulnerability does not impact confidentiality, integrity, or availability directly but poses a risk of user redirection to untrusted sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the non-default option that enables the vulnerable redirect handler or implement additional validation controls on redirects if possible.