CVE-2026-103997

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.16

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can view the entire Redux options payload, which may include plaintext password field values, API keys, license keys, and SMTP credentials. This information is exposed within the inline redux <opt name> JavaScript block on the 'wp-admin/profile.php' endpoint. The issue persists across all sites running the framework because the Users extension is automatically loaded for every registered Redux instance.

Recommendations Update Redux Framework to version 4.5.16 or later.