Vulnerabilities / Redux Framework / WPSEC-2026-2320
Redux Framework <= 4.5.16 - Authenticated (Contributor+) Sensitive Information Exposure via Localized Admin JavaScript
Medium 4.3
CWE-200Fixed in 4.5.17
- ID
- WPSEC-2026-2320
- Plugin
- Redux Framework (redux-framework)
- Affected
- all versions before 4.5.17
- Remediation
- Update to 4.5.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Redux Framework on WPSec AttackSurface
- Fix released
- Published
Description
The Redux Framework plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.16. The plugin localized the complete options array and defaults into the inline redux_<opt_name> JavaScript on every admin page where it enqueues assets, such as the post and term edit screens, without restricting it to the fields the user is permitted to see. This makes it possible for authenticated attackers, with contributor-level access and above, to read all of the plugin's or theme's stored options, which may include sensitive data such as API keys.
References
- https://wpsec.com/vuln/WPSEC-2026-2320/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/
- https://wordpress.org/plugins/redux-framework/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS