# Redux Framework <= 4.5.16 - Authenticated (Contributor+) Sensitive Information Exposure via Localized Admin JavaScript

- **ID:** WPSEC-2026-2320
- **Plugin:** Redux Framework (`redux-framework`), https://wordpress.org/plugins/redux-framework/
- **Affected versions:** all versions before 4.5.17
- **Fixed in:** 4.5.17 (Update to 4.5.17 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/redux-framework
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2320/

## Description

The Redux Framework plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.16. The plugin localized the complete options array and defaults into the inline redux_<opt_name> JavaScript on every admin page where it enqueues assets, such as the post and term edit screens, without restricting it to the fields the user is permitted to see. This makes it possible for authenticated attackers, with contributor-level access and above, to read all of the plugin's or theme's stored options, which may include sensitive data such as API keys.

## References

- https://wpsec.com/vuln/WPSEC-2026-2320/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/
- https://wordpress.org/plugins/redux-framework/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2320/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.