Cross-Site Request Forgery Vulnerability in Clearfy Cache Plugin for WordPress
CVE-2025-13749

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Clearfy Cache – WordPress Optimization Plugin, Minify Html, Css & Js, Defer
Vendor
CVE Published:
9 January 2026

What is CVE-2025-13749?

The Clearfy Cache plugin for WordPress has a vulnerability that allows unauthenticated attackers to execute Cross-Site Request Forgery attacks. Specifically, the 'wbcr_upm_change_flag' function lacks proper nonce validation, enabling attackers to send forged requests. If successful, this could allow them to disable update notifications for plugins and themes, potentially impacting site security. Site administrators who fall for social engineering tactics, like clicking on malicious links, are at risk.

Affected Version(s)

Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer 0 <= 2.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://research.cleantalk.org/cve-2025-13749/
https://plugins.trac.wordpress.org/changeset/3421009/clearfy

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.