Clearfy Cache WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Clearfy Cache WordPress optimization plugin, specifically in versions through 2.4.0. The issue arises from a lack of nonce validation in the 'wbcr_upm_change_flag' function, allowing unauthenticated attackers to disable plugin or theme update notifications. This could be achieved by tricking a site administrator into clicking a link that sends a forged request.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin or theme update notification settings, potentially leading to missed important updates or security patches.

Remediation

Users are advised to update the Clearfy Cache WordPress plugin to version 2.4.1 or later.