CVE-2026-110705 in Redux Framework Plugin
Summary
by MITRE • 11/07/2026
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified in the Redux Framework for WordPress represents a critical authorization bypass flaw affecting all versions up to and including 4.5.16. This security defect stems from an improper verification of user permissions during administrative actions, specifically within the context of exporting configuration data. The core issue lies in the plugin's failure to adequately restrict access to sensitive export functions based on the requesting user's role. While these operations are intended to be reserved for users with administrator privileges, the implementation allows authenticated attackers possessing subscriber-level access or higher to execute them successfully. This misconfiguration effectively undermines the principle of least privilege, allowing lower-privileged accounts to perform actions that should require elevated trust levels within the WordPress ecosystem.
The operational impact of this vulnerability is severe due to the nature of the data exposed through the Redux options panel export functionality. When exploited, an attacker can retrieve a comprehensive configuration dump that includes highly sensitive credentials and tokens. This payload typically contains API keys for third-party services, SMTP server credentials used for email delivery, license keys for premium software integrations, and various other authentication tokens. The exposure of these secrets compromises the confidentiality and integrity of the entire web application infrastructure. Attackers can use this information to impersonate legitimate users, access external APIs with elevated privileges, or further compromise related systems that rely on the same credentials, leading to potential data breaches and service disruption.
The technical mechanism enabling this exploitation relies on a specific interaction between theme developers and the Redux Framework via the Redux_Users::set_profile() function. When a theme or plugin registers an import_export field for user profiles, the framework generates a nonce value intended to prevent cross-site request forgery attacks during administrative operations. However, in vulnerable versions, this nonce is incorrectly rendered into the HTML source of the subscriber's own profile page at /wp-admin/profile.php. Because the nonce is publicly visible in the client-side code without any server-side validation restricting its usage to administrator roles only, an attacker with basic authenticated access can simply parse the page source to extract it. This allows them to craft valid requests that bypass authorization checks entirely, as the system accepts the nonce as proof of legitimate intent regardless of the user's actual permission level.
From a classification perspective, this vulnerability aligns closely with CWE-285, which describes Improper Authorization, where an actor is able to access or perform functions for which they should not have been allowed. Additionally, it maps to MITRE ATT&CK technique T1078, specifically Valid Accounts, as the exploitation requires initial authentication but leverages misconfigured permissions rather than credential theft in the traditional sense. The flaw also exhibits characteristics of CWE-352, Cross-Site Request Forgery (CSRF), due to the improper handling and exposure of nonces that are meant to validate state-changing requests. Understanding these mappings is crucial for security teams assessing similar implementations across other plugins or custom themes that utilize the Redux Framework.
To mitigate this risk, immediate action is required by updating the Redux Framework plugin to a version newer than 4.5.16 where the authorization logic has been corrected. Developers and site administrators should verify that no older versions remain active on any WordPress installations under their control. For environments unable to update immediately due to compatibility constraints, temporary mitigations include restricting access to /wp-admin/profile.php through web server configuration or firewall rules if feasible, although this is less effective since the attacker already has authenticated access. Furthermore, auditing themes and plugins for calls to Redux_Users::set_profile() can help identify instances where nonces might be improperly exposed. Regular security audits focusing on authorization checks in admin-facing endpoints are recommended to prevent similar privilege escalation vulnerabilities from being introduced through future plugin or theme updates.