CVE-2026-16296 WordPress — Exploit & Vulnerability Details NONE

Parameter	Value
Affected Versions	before 2.4.3
Vendor	WordPress
Public PoC	No

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.