{
 "id": "WPSEC-2026-2320",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2320/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2320/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2320/index.md",
 "title": "Redux Framework <= 4.5.16 - Authenticated (Contributor+) Sensitive Information Exposure via Localized Admin JavaScript",
 "description": "The Redux Framework plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.16. The plugin localized the complete options array and defaults into the inline redux_<opt_name> JavaScript on every admin page where it enqueues assets, such as the post and term edit screens, without restricting it to the fields the user is permitted to see. This makes it possible for authenticated attackers, with contributor-level access and above, to read all of the plugin's or theme's stored options, which may include sensitive data such as API keys.",
 "plugin": {
  "slug": "redux-framework",
  "name": "Redux Framework",
  "full_name": "Redux Framework",
  "wordpress_org": "https://wordpress.org/plugins/redux-framework/",
  "advisories_url": "https://wpsec.com/vuln/plugin/redux-framework/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/redux-framework"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.17"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.17",
 "remediation": "Update to 4.5.17 or later.",
 "fix_released": "2026-11-02T10:22:44+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:59.978422+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2320/",
  "https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/",
  "https://wordpress.org/plugins/redux-framework/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/redux-framework",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}