The Clearfy Cache WordPress plugin versions prior to 2.4.3 do not restrict the classes allowed when unserializing settings-import data. This improper restriction enables users with administrator privileges to conduct PHP Object Injection attacks. Such attacks can potentially lead to remote code execution if the environment contains a suitable gadget chain. The vulnerability is tracked as CWE-502 (Deserialization of Untrusted Data). No official patch or remediation guidance is currently provided in the available data.

An attacker with administrator access can exploit this vulnerability to perform PHP Object Injection, which may result in remote code execution. The impact includes potential compromise of the WordPress environment and execution of arbitrary code. The CVSS score of 4.1 reflects a medium severity with network attack vector, high attack complexity, and required privileges of administrator level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to settings import functionality. Avoid importing untrusted serialized data.