{"id":"CVE-2026-110705","aliases":["EUVD-2026-118906","GHSA-p9qg-3fh2-pj3p"],"status":"published","title":"Redux Framework \u003c= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action","description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00345,"percentile":0.28203,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-07T04:27:13Z","modified":"2026-11-08T02:47:26Z","products":[{"vendor":"davidanderson","product":"redux framework"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414534fa-80d0-4885-8c13-c9a8e707665b?source=cve","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L103","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/import_export/class-redux-import-export.php#L69","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L147","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php#L52","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/extensions/users/class-redux-extension-users.php#L709","tags":["web"]},{"url":"https://github.com/reduxframework/redux-framework/pull/4125","tags":["fix"]},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.17/redux-core/inc/extensions/import_export/class-redux-extension-import-export.php","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110705","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p9qg-3fh2-pj3p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110705.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-110705","title":"Redux Framework \u003c= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action","description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.","status":"published","published":"2026-11-07T04:27:13.221Z","modified":"2026-11-07T18:36:43.041Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-07T05:32:42.683254Z"}],"euvd":[{"id":"EUVD-2026-118906","description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.","status":"published","published":"2026-11-07T04:27:13Z","modified":"2026-11-07T18:36:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T09:08:56.024426Z"}],"ghsa":[{"id":"GHSA-p9qg-3fh2-pj3p","title":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up...","description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.","status":"published","published":"2026-11-07T06:31:15Z","modified":"2026-11-07T06:31:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-07T06:35:59.993073Z"}],"nvd":[{"id":"CVE-2026-110705","description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.","status":"published","published":"2026-11-07T05:18:00.85Z","modified":"2026-11-07T19:17:17.973Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-07T22:06:52.100138Z"}],"osv":[{"id":"CVE-2026-110705","title":"Redux Framework \u003c= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action","description":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.","status":"published","published":"2026-11-07T04:27:13.221Z","modified":"2026-11-09T02:30:45.105003903Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-08T02:57:19.626258Z"}]}}