CVE-2025-13749: 
WordPress vulnerability analysis and mitigation

CVE-2025-13749 is a Cross-Site Request Forgery (CSRF) vulnerability in the Clearfy Cache WordPress plugin (also known as "WordPress optimization plugin, Minify HTML, CSS & JS, Defer") affecting all versions up to and including 2.4.0. The flaw was disclosed on January 9, 2026, and was reported by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from missing nonce validation on the wbcr_upm_change_flag function within the Clearfy Cache plugin. Because no nonce or equivalent anti-CSRF token is verified before processing the request, an unauthenticated attacker can craft a forged HTTP request that, when triggered by a logged-in administrator (e.g., via a malicious link), silently disables plugin and theme update notifications on the WordPress site. No authentication or special privileges are required on the attacker's part; only user interaction from an administrator is needed (Wordfence, CleanTalk Research).

Successful exploitation allows an attacker to disable plugin and theme update notifications for the affected WordPress site, preventing administrators from being alerted to available security patches. This indirect impact can leave the site exposed to other known vulnerabilities in outdated plugins or themes for an extended period, increasing the overall attack surface. Confidentiality and availability are not directly impacted; the integrity impact is limited to the suppression of update notification settings (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13749. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick a site administrator into clicking a crafted link, which limits its practical exploitability (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Clearfy Cache plugin at version 2.4.0 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct a forged HTTP GET or POST request targeting the wbcr_upm_change_flag function endpoint in the Clearfy Cache plugin, designed to disable update notifications.
3. Deliver payload: Embed the forged request URL in a phishing email, comment, or other communication directed at a WordPress site administrator, disguised as a legitimate link.
4. Administrator interaction: When the administrator clicks the link while authenticated to their WordPress dashboard, the browser automatically sends the forged request with the administrator's session cookies, triggering the CSRF action.
5. Effect: The plugin/theme update notifications are silently disabled, leaving the site unaware of future security updates (Wordfence, CleanTalk Research).

• Logs: WordPress admin action logs showing unexpected calls to the wbcr_upm_change_flag function, particularly from unusual referrer URLs or at unexpected times.
• Configuration: Plugin or theme update notifications found disabled in the Clearfy Cache plugin settings without a corresponding administrator action.
• Network: HTTP requests to the WordPress admin AJAX endpoint (/wp-admin/admin-ajax.php or similar) referencing wbcr_upm_change_flag originating from external or unexpected referrer domains.

Users should update the Clearfy Cache plugin to a version beyond 2.4.0 that includes proper nonce validation on the wbcr_upm_change_flag function. The fix is available in the plugin repository changeset 3421009. As a general workaround, administrators should be cautious about clicking unsolicited links while logged into their WordPress dashboard, and consider using a WordPress security plugin that enforces CSRF protections site-wide (WordPress Plugin Changeset, Wordfence).