Authorization Bypass in Redux Framework Plugin for WordPress

CVE-2026-103997

What is CVE-2026-103997?

The Redux Framework plugin for WordPress is susceptible to an authorization bypass, allowing authenticated users (with subscriber-level access and above) to access sensitive configuration data. This vulnerability stems from the plugin's failure to properly verify user permissions when performing certain actions. Consequently, critical information such as plaintext passwords, API keys, license keys, and SMTP credentials can be exposed through the inline JavaScript block on the wp-admin/profile.php page. Importantly, the Users extension is automatically loaded for all Redux instances, making all sites using the Redux Framework vulnerable, regardless of specific developer configurations.

References