---
id: "CVE-2026-103997"
kind: "vulnerability"
aliases: ["CVE-2026-103997"]
title: "Redux Framework WordPress plugin: subscribers can read stored API keys and passwords"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "redux-framework", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "no-public-registration", "no-redux-framework"]
published_at: "2026-10-31T08:16:47+00:00"
first_seen_at: "2026-10-31T08:34:28+00:00"
updated_at: "2026-10-31T08:35:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103997", "first_seen_at": "2026-10-31T08:34:28+00:00"}]
---

# Redux Framework WordPress plugin: subscribers can read stored API keys and passwords

The Redux Framework plugin for WordPress, up to and including 4.5.15, fails to check authorization when rendering the profile page, so any logged-in subscriber can see the full Redux options payload. That payload can include plaintext passwords, API keys, license keys and SMTP credentials stored by themes or plugins.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Redux Framework plugin is installed and its version is at or below `4.5.15` in the WordPress plugins list or `wp-content/plugins/redux-framework/`.
- Check whether any theme or plugin registers a Redux instance, since the Users extension loads automatically for each one.

## Timeline

- 2026-10-31T08:34:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103997

## From the sources

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the entire Redux options payload — including plaintext password field values, API keys, license keys, and SMTP credentials — exposed in the inline redux_<opt_name> JavaScript block on wp-admin/profile.php. The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, meaning any site running Redux Framework is affected regardless of whether the developer explicitly configured the Users extension.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_