CVE-2026-110705— Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action

Quick assessment

Affected

davidanderson Redux Framework

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Redux Framework 插件在所有 4.5.16 及以下版本中存在授权绕过漏洞。该漏洞源于插件未能正确验证用户是否有权执行特定操作。这使得拥有订阅者（Subscriber）级别及以上权限的已认证攻击者，能够导出整个 Redux 选项面板配置——包括 API 密钥、SMTP 凭据、许可证密钥以及第三方令牌——而这些内容本应仅限管理员访问。利用该漏洞需要满足一个前提条件：某个主题或插件通过方法在用户资料中注册了 Redux 的字段。这一操作会导致安全令牌（nonce）被输出到订阅者

CVSS 5.3 · Medium Updated Nov 07, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action

Source: CVE Program / CVE List V5

Vulnerability Description

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
davidanderson	Redux Framework	0 ~ 4.5.16	-

II. Public POCs for CVE-2026-110705

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110705

请登录查看更多情报信息。

Other References for CVE-2026-110705 (8)

https://www.cve.org/CVERecord?id=CVE-2026-110705

IV. Related Vulnerabilities

Same product: Redux Framework

Same vendor: davidanderson

Same weakness: CWE-862