CVE-2026-110705 · Package
NO FIX YET · SEE WHAT TO DO
The Redux Framework plugin for WordPress up to and including 4.5.16 fails to check authorization on its options export action. An authenticated subscriber can export the full options panel, including API keys, SMTP credentials, licence keys and third-party tokens, when a theme or plugin exposes the import/export field on user profiles.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running Redux Framework 4.5.16 or earlier where a theme or plugin registers a Redux import_export field on user profiles, and where subscribers or other low-privilege users can log in. Sites without that registration, or without public user accounts, are much less exposed. Sites that do not run Redux Framework are not affected.
Not affected if no-redux-framework, no-subscriber-accounts, no-user-profile-import-export
Who cares redux-framework, self-hosted, wordpress
wp plugin get redux-framework --field=versionRedux_Users::set_profile() with an import_export fieldThe Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.