{"id":"CVE-2026-116404","kind":"vulnerability","aliases":["CVE-2026-116404"],"related":[],"title":"Redux Framework: missing authorization lets attackers read cached sensitive data","description":"Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16.","summary":"Redux Framework, a WordPress options framework, has a missing authorization check that lets an attacker pull sensitive data embedded in its cache. The advisory covers all versions through 4.5.16.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","redux-framework","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed redux-framework plugin version in the WordPress admin plugins list or with `wp plugin get redux-framework --field=version`\n- Confirm whether the site runs redux-framework at all with `wp plugin is-active redux-framework`","fix":"- Update redux-framework to a release later than `4.5.16` once the vendor publishes a patched version (the sources do not name one)\n- Until patched, unknown whether deactivating the plugin or rotating secrets stored in its options is required","status":"open","published_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:21+00:00","updated_at":"2026-10-28T13:34:21+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T13:34:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update redux-framework to a release later than `4.5.16` once the vendor publishes a patched version (the sources do not name one)\n- Until patched, unknown whether deactivating the plugin or rotating secrets stored in its options is required","reach":"unknown","title":"Redux Framework: missing authorization lets attackers read cached sensitive data","impact":"medium","summary":"Redux Framework, a WordPress options framework, has a missing authorization check that lets an attacker pull sensitive data embedded in its cache. The advisory covers all versions through 4.5.16.","category":"package","nicknames":[],"who_cares":["wordpress","redux-framework","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads sensitive data stored in plugin cache","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the patched version, auth requirement and exact data exposed.","how_to_check":"- Check the installed redux-framework plugin version in the WordPress admin plugins list or with `wp plugin get redux-framework --field=version`\n- Confirm whether the site runs redux-framework at all with `wp plugin is-active redux-framework`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the redux-framework WordPress plugin at version 4.5.16 or earlier are affected, typically themes and plugins that bundle it for options pages. Sites without the plugin installed can skip it. The sources do not say whether unauthenticated access is possible.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3298,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116404':13A,16A '-2026':12A,15A '4.5.16':53B,79C 'advisori':48B 'affect':73C 'allow':65C 'anderson':59C 'attack':6A,39B 'author':4A,34B,55C 'cach':8A,46B 'cache.this':71C 'check':35B 'cover':49B 'cve':11A,14A 'data':10A,42B,68C 'david':58C 'embed':43B,69C 'framework':2A,20B,26B,30B,61C,64C,75C 'host':23B 'issu':72C 'let':5A,37B 'lift':66C 'miss':3A,33B,54C 'n/a':77C 'option':29B 'packag':17B 'pull':40B 'read':7A 'redux':1A,19B,25B,60C,63C,74C 'redux-framework':18B,62C 'self':22B 'self-host':21B 'sensit':9A,41B,67C 'version':51B 'vulner':56C 'wordpress':24B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the redux-framework WordPress plugin at version 4.5.16 or earlier are affected, typically themes and plugins that bundle it for options pages. Sites without the plugin installed can skip it. The sources do not say whether unauthenticated access is possible.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116404","severity":null,"published_at":"2026-10-28T13:17:06+00:00","modified_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}