CVE-2026-16296 is an open redirect vulnerability (CWE-601) in the Clearfy Cache WordPress plugin prior to version 2.4.3. The vulnerability arises because the plugin's Cyrlitera old-URL redirect handler passes a decoded request URI to an unsafe redirect function without validating the target URL. This flaw enables unauthenticated attackers to redirect users to arbitrary external URLs when a non-default option is enabled in the plugin configuration.

An attacker can exploit this vulnerability to redirect visitors of a website using the affected Clearfy Cache plugin to arbitrary external URLs. This can facilitate phishing attacks or redirect users to malicious websites, potentially leading to further compromise or user deception. There is no indication of direct code execution or data breach from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.4.3, upgrading to version 2.4.3 or later (once confirmed) is recommended if available. Until an official fix is released, consider disabling the non-default option that enables this redirect handler or implementing additional validation controls on redirects.