The Cache Cleaner extension for Joomla suffers from a CSRF vulnerability (CWE-352) where administrator URL purge actions do not consistently enforce the presence of a valid CSRF token or verify cache-management permissions. This inconsistency could enable attackers to trick authenticated administrators into executing unwanted cache purge operations. The affected versions are exactly 1.0.0 through 9.7.6. There is no CVSS score or vendor advisory detailing a fix or mitigation at this time.

Successful exploitation could allow an attacker to perform unauthorized cache purge operations by leveraging the lack of consistent CSRF token validation and permission checks. This may lead to disruption of normal cache management processes but does not directly indicate data leakage or privilege escalation beyond cache management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious when interacting with cache purge URLs and consider restricting access to the Cache Cleaner administrative interface. Implementing web application firewall (WAF) rules to detect and block CSRF attempts may provide temporary protection.