The Clearfy plugin suffers from a Cross‑Site Request Forgery flaw caused by missing nonce validation in the wbcr_upm_change_flag function. An attacker can forge a request that, if an administrator clicks a malicious link, will disable plugin or theme update notifications. This weakens security monitoring and can allow critical updates to be missed. The vulnerability is categorized as CWE-352.

WordPress sites utilizing Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer from CreativeMotion; all releases up to and including version 2.4.0 are vulnerable. No specific sub‑versions are listed beyond this threshold.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator to unknowingly click a forged link, thus the attack vector is CSRF with user interaction. The impact is confined to the ability to silence update notifications, rather than remote code execution or full control of the site.