Authorization Bypass in Redux Framework Plugin for WordPress

CVE-2026-88999

What is CVE-2026-88999?

The Redux Framework plugin for WordPress is at risk of an authorization bypass that allows attackers with subscriber-level access or higher to delete media library attachments, including files owned by administrators. This vulnerability arises from insufficient user authorization checks when a Custom Fonts field is integrated into the user profile page. Specifically, it becomes exploitable when the redux_custom_fonts nonce is exposed in the profile management interface, enabling unauthorized deletions of crucial site content.

References