CVE-2026-88999

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can delete arbitrary media library attachments, including files owned by administrators. This occurs when a Custom Fonts field is registered on the user profile page via the set profile() function in Redux Users, which causes the redux custom fonts nonce to be rendered on the wp-admin/profile.php page.

Recommendations Update Redux Framework to version 4.5.15 or later.