How do I check whether I am affected by CVE-2026-116404?

- Check the installed redux-framework plugin version in the WordPress admin plugins list or with `wp plugin get redux-framework --field=version` - Confirm whether the site runs redux-framework at all with `wp plugin is-active redux-framework`

What is the fix for CVE-2026-116404?

- Update redux-framework to a release later than `4.5.16` once the vendor publishes a patched version (the sources do not name one) - Until patched, unknown whether deactivating the plugin or rotating secrets stored in its options is required

Who is not affected by CVE-2026-116404?

Not affected if: plugin-not-installed.

Live › vulnerability › CVE-2026-116404

Go to dashboard

medium6.5Package

Redux Framework: missing authorization lets attackers read cached sensitive data

Redux Framework, a WordPress options framework, has a missing authorization check that lets an attacker pull sensitive data embedded in its cache. The advisory covers all versions through 4.5.16.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

6.5

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker reads sensitive data stored in plugin cache.
CVSS said: 6.5. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Sites running the redux-framework WordPress plugin at version 4.5.16 or earlier are affected, typically themes and plugins that bundle it for options pages. Sites without the plugin installed can skip it. The sources do not say whether unauthenticated access is possible.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-116404

Go to dashboard

medium6.5Package

Redux Framework: missing authorization lets attackers read cached sensitive data

Redux Framework, a WordPress options framework, has a missing authorization check that lets an attacker pull sensitive data embedded in its cache. The advisory covers all versions through 4.5.16.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

6.5

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker reads sensitive data stored in plugin cache.
CVSS said: 6.5. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Redux Framework: missing authorization lets attackers read cached sensitive data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Redux Framework: missing authorization lets attackers read cached sensitive data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources