Redux Framework CVE-2026-103997

Requires an authenticated account with subscriber-level access or above on the target WordPress site (per CVSS PR:L); it is most impactful on sites that permit open user self-registration. The attacker simply needs to load wp-admin/profile.php and read the inline redux_<opt_name> JavaScript block in the page source - no special Redux configuration is required, because the Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, so any site running Redux Framework ≤4.5.15 is affected regardless of whether the developer configured the Users extension. The practical limit on impact is twofold: a valid low-privilege account is needed (no anonymous exploitation), and the severity of what leaks depends on whether the site actually stores secrets - plaintext passwords, API keys, license keys, SMTP credentials - in its Redux options.

This is a genuine but moderate-priority issue, not a drop-everything emergency, and the input signals are consistent in pointing to that. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, authenticated flaw with no user interaction, high confidentiality impact and no integrity or availability impact - i.e. a pure information-disclosure bug. The vuln.today Decision label is 'this_month' (not act_now/emergency), which aligns with a credential-exposure flaw that still requires an attacker to already hold a valid account. Authentication requirement is confirmed from the vector: PR:L means an authenticated attacker with subscriber-level access or above, so this cannot be exploited by fully anonymous visitors. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact fields were provided in the input, so exploitation-probability and automatability cannot be quantified here. No public exploit code is referenced - the GitHub link is the vendor fix pull request, not a working exploit - so there is no public exploit identified at time of analysis. The main factor elevating real-world concern above the raw 6.5 is the nature of what leaks (plaintext passwords, API keys, license keys and SMTP credentials) combined with the low bar of subscriber access on sites that allow self-registration; the factor containing it is that an account is required and the data only leaks where a site has actually stored secrets in Redux options.

On a WordPress site that allows user self-registration, an attacker registers a low-privileged subscriber account, logs in, and opens wp-admin/profile.php. They then read the page source and extract the inline redux_<opt_name> JavaScript block, which serializes the full Redux options payload - potentially including plaintext passwords, API keys, license keys and SMTP credentials - without any authorization check. No public exploit code is referenced, and given AV:N/AC:L the technique is trivial to reproduce manually once an account exists.