The Clearfy Cache WordPress plugin, before version 2.4.3, fails to restrict the classes that may be deserialized when a user imports settings data. An administrator could supply crafted serialized payloads containing malicious PHP objects, leading to PHP Object Injection. If the WordPress environment contains a suitable gadget chain, the attacker can execute arbitrary code, effectively taking full control of the web server.

The vulnerability exists in the Clearfy Cache WordPress plugin versions earlier than 2.4.3. Any site that has installed this plugin and allows administrators to import settings is affected. The flaw is active for all users with administrator privileges on the affected WordPress installation.

The exploit requires the attacker to be authenticated as a site administrator, which is a narrow attack surface. Once the payload is imported, the vulnerability can lead to remote code execution on the host. The CVSS score is 4.1 and the EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog, but its potential impact and the remote code execution nature warrant concern. The revision of the plugin that closes the flaw is the critical mitigating factor.