Live › vulnerability › CVE-2026-103997
The Redux Framework plugin for WordPress, up to and including 4.5.15, fails to check authorization when rendering the profile page, so any logged-in subscriber can see the full Redux options payload. That payload can include plaintext passwords, API keys, license keys and SMTP credentials stored by themes or plugins.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 08:34 UTC. All times on this page are UTC.
Any WordPress site running Redux Framework up to and including 4.5.15, whether or not the Users extension was configured, because it loads automatically for every Redux instance registered by an installed theme or plugin. Attackers need a logged-in account with subscriber-level access or higher, so sites that allow no public registration are at lower risk. Sites that store secrets in Redux options are most exposed.
No product ranges from the sources yet.
4.5.15 in the WordPress plugins list or wp-content/plugins/redux-framework/.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the entire Redux options payload — including plaintext password field values, API keys, license keys, and SMTP credentials — exposed in the inline redux_<opt_name> JavaScript block on wp-admin/profile.php. The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, meaning any site running Redux Framework is affected regardless of whether the developer explicitly configured the Users extension.
This page as .md · .json · in your agent: get_signal("CVE-2026-103997")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.