Redux Framework CVE-2026-116404

Exploitation requires a valid low-privileged authenticated account on the target WordPress site (CVSS PR:L), on a site that has Redux Framework at version 4.5.16 or earlier installed (directly or bundled via a theme/plugin). The flaw is a missing authorization check (CWE-862) that lets such a user retrieve sensitive data embedded in the framework's cache; the specific endpoint, parameter, or configuration that triggers the disclosure is not described in the available sources. Limiting factors: the attacker must already be able to authenticate (not fully anonymous), the impact is confined to confidentiality (no data modification or denial of service), and no user interaction is required (UI:N). No fixed version is given in the supplied data, so remediation should track the vendor/Patchstack advisory for an update.

This is a moderate-severity, authenticated information-disclosure flaw (CVSS 6.5) rather than a critical priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) - i.e. an authenticated account - and yields only a high confidentiality impact with no integrity or availability effect, consistent with CWE-862 (Missing Authorization) exposing sensitive data embedded in cache. The vuln.today decision label is 'this_month,' signalling prioritised-but-not-emergency remediation. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the single Patchstack reference is a vulnerability-database advisory, not working exploit code. The combination of required authentication, confidentiality-only impact, and absence of exploitation signals means this should be patched in a routine cycle rather than treated as an active-threat emergency, though the very wide deployment of Redux Framework raises aggregate exposure. Conflict to note: the tag 'Authentication Bypass' overstates the issue - CWE-862 and PR:L indicate a missing authorization check on an already-authenticated user, not an authentication bypass.

A low-privileged authenticated WordPress user (e.g. a subscriber-level account on a site running a theme or plugin that bundles Redux Framework ≤4.5.16) sends a crafted request to a Redux Framework endpoint that lacks a proper authorization check. The missing authorization allows them to read sensitive data embedded in the framework's cache that should be restricted to higher-privileged roles. No public exploit was identified at time of analysis.