{
 "id": "WPSEC-2026-0911",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0911/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0911/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0911/index.md",
 "title": "Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Profile Page Localized Options",
 "description": "The Redux Framework plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.15, due to the Users extension localizing the complete option set and defaults of every Redux panel into the inline redux_<opt_name> JavaScript on user profile pages without checking whether the user can access the options panel. This makes it possible for authenticated attackers with Subscriber-level access and above to read the stored option values of a Redux-based theme or plugin, which may include sensitive values such as API keys, from the source of their own profile page.",
 "plugin": {
  "slug": "redux-framework",
  "name": "Redux Framework",
  "full_name": "Redux Framework",
  "wordpress_org": "https://wordpress.org/plugins/redux-framework/",
  "advisories_url": "https://wpsec.com/vuln/plugin/redux-framework/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/redux-framework"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.4.1",
    "from_inclusive": true,
    "to": "4.5.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.4.1 before 4.5.16"
  ]
 },
 "introduced_in": "4.4.1",
 "fixed_in": "4.5.16",
 "remediation": "Update to 4.5.16 or later.",
 "fix_released": "2026-10-12T10:00:16+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:37.988263+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0911/",
  "https://plugins.svn.wordpress.org/redux-framework/tags/4.5.16/",
  "https://wordpress.org/plugins/redux-framework/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/redux-framework",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}