{"affected":[{"defaultStatus":"unaffected","product":"Redux Framework","source":"CNA: Wordfence","vendor":"davidanderson","versions":[{"lessThanOrEqual":"4.5.16","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-110705","cwes":["CWE-862"],"description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.","epss":{"date":"2026-11-07","percentile":0.28162,"score":0.00345},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794076603041,"publishedAt":1794025633221,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414534fa-80d0-4885-8c13-c9a8e707665b?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L103"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/import_export/class-redux-import-export.php#L69"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L147"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L52"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/users/class-redux-extension-users.php#L709"},{"source":"CNA: Wordfence","tags":[],"url":"https://github.com/reduxframework/redux-framework/pull/4125"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.17/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php"},{"source":"security@wordfence.com","tags":[],"url":"https://github.com/reduxframework/redux-framework/pull/4125"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L103"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L147"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L52"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/import_export/class-redux-import-export.php#L69"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/users/class-redux-extension-users.php#L709"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.17/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414534fa-80d0-4885-8c13-c9a8e707665b?source=cve"}],"remediation":[],"revision":"9a2c042988ca852d341c869371c9d3919ccc648c7101d11cd0c1919702887bc5","sources":[{"modifiedAt":1794076603041,"name":"CNA: Wordfence","retrievedAt":1794078511247,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110705"},{"modifiedAt":1794028681017,"name":"NVD","retrievedAt":1794032179592,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110705"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794078528688,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110705"}],"ssvc":{"assessedAt":1794074924704,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action","updatedAt":1794078528688}