{"id":"CVE-2026-103997","kind":"vulnerability","aliases":["CVE-2026-103997"],"related":[],"title":"Redux Framework WordPress plugin: subscribers can read stored API keys and passwords","description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the entire Redux options payload — including plaintext password field values, API keys, license keys, and SMTP credentials — exposed in the inline redux_<opt_name> JavaScript block on wp-admin/profile.php. The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, meaning any site running Redux Framework is affected regardless of whether the developer explicitly configured the Users extension.","summary":"The Redux Framework plugin for WordPress, up to and including 4.5.15, fails to check authorization when rendering the profile page, so any logged-in subscriber can see the full Redux options payload. That payload can include plaintext passwords, API keys, license keys and SMTP credentials stored by themes or plugins.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","redux-framework","self-hosted","wordpress"],"not_affected_if":["auth-required","no-public-registration","no-redux-framework"],"how_to_check":"- Check whether the Redux Framework plugin is installed and its version is at or below `4.5.15` in the WordPress plugins list or `wp-content/plugins/redux-framework/`.\n- Check whether any theme or plugin registers a Redux instance, since the Users extension loads automatically for each one.","fix":null,"status":"open","published_at":"2026-10-31T08:16:47+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","triaged_at":"2026-10-31T08:35:10+00:00","updated_at":"2026-10-31T08:35:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T08:35:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Redux Framework WordPress plugin: subscribers can read stored API keys and passwords","impact":"high","summary":"The Redux Framework plugin for WordPress, up to and including 4.5.15, fails to check authorization when rendering the profile page, so any logged-in subscriber can see the full Redux options payload. That payload can include plaintext passwords, API keys, license keys and SMTP credentials stored by themes or plugins.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","redux-framework","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"subscriber reads stored API keys, passwords and SMTP credentials","analyst_note":"Confirm the patched version of Redux Framework; the sources give no fixed release.","how_to_check":"- Check whether the Redux Framework plugin is installed and its version is at or below `4.5.15` in the WordPress plugins list or `wp-content/plugins/redux-framework/`.\n- Check whether any theme or plugin registers a Redux instance, since the Users extension loads automatically for each one.","plain_action":"","needs_analyst":true,"not_affected_if":["no-redux-framework","auth-required","no-public-registration"],"who_is_affected":"Any WordPress site running Redux Framework up to and including 4.5.15, whether or not the Users extension was configured, because it loads automatically for every Redux instance registered by an installed theme or plugin. Attackers need a logged-in account with subscriber-level access or higher, so sites that allow no public registration are at lower risk. Sites that store secrets in Redux options are most exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4271,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103997':15A,18A '-2026':14A,17A '/profile.php':161C '4.5.15':37B,96C 'access':126C 'action':114C 'admin':160C 'affect':186C 'api':9A,66B,141C 'attack':121C 'authent':120C 'author':41B,87C,110C 'automat':167C 'block':156C 'bypass':88C 'check':40B 'configur':193C 'credenti':72B,147C 'cve':13A,16A 'develop':191C 'due':99C 'entir':132C 'everi':169C 'explicit':192C 'expos':148C 'extens':164C,196C 'fail':38B 'field':139C 'framework':2A,22B,29B,80C,184C 'full':56B 'host':25B 'includ':36B,63B,95C,136C 'inlin':151C 'instal':175C 'instanc':171C 'javascript':155C 'key':10A,67B,69B,142C,144C 'level':125C 'licens':68B,143C 'load':166C 'log':50B 'logged-in':49B 'make':116C 'mean':179C 'name':154C 'opt':153C 'option':58B,134C 'packag':19B 'page':46B 'password':12A,65B,138C 'payload':59B,61B,135C 'perform':112C 'plaintext':64B,137C 'plugin':4A,30B,77B,81C,102C,178C 'possibl':118C 'profil':45B 'proper':104C 'read':7A 'redux':1A,21B,28B,57B,79C,133C,152C,170C,183C 'redux-framework':20B 'regardless':187C 'regist':172C 'render':43B 'run':182C 'see':54B 'self':24B 'self-host':23B 'site':181C 'smtp':71B,146C 'store':8A,73B 'subscrib':5A,52B,124C 'subscriber-level':123C 'theme':75B,176C 'user':108C,163C,195C 'valu':140C 'verifi':105C 'version':91C 'view':130C 'vulner':85C 'whether':189C 'wordpress':3A,26B,32B,83C 'wp':159C 'wp-admin':158C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running Redux Framework up to and including 4.5.15, whether or not the Users extension was configured, because it loads automatically for every Redux instance registered by an installed theme or plugin. Attackers need a logged-in account with subscriber-level access or higher, so sites that allow no public registration are at lower risk. Sites that store secrets in Redux options are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T08:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103997","severity":null,"published_at":"2026-10-31T08:16:47+00:00","modified_at":"2026-10-31T08:16:47+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","fetched_at":"2026-10-31T08:34:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}