EUVD-2026-90501
GHSA-f7hj-396j-9g77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber account
-
DeliveryLoad own profile.php page
-
ExploitRead rendered redux_custom_fonts nonce
-
ExecutionSubmit deletion with arbitrary attachment_id
-
ImpactDelete admin-owned media attachments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Subscriber-level (or higher) account on the target WordPress site. The decisive non-default prerequisite is that a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), because only then is the required redux_custom_fonts nonce rendered into the Subscriber's own wp-admin/profile.php, giving the attacker the token needed to invoke the unprotected attachment-deletion action. Without that profile-page Custom Fonts registration, the Subscriber cannot obtain the nonce and the path is not reachable. Impact is limited to deletion of media library attachments (including administrator-owned files); there is no confidentiality exposure or code execution. |
| Impact | This is a genuine-but-bounded issue, not a high-severity priority. The vendor (Wordfence) CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) correctly captures a low-impact, integrity-only flaw: a low-privileged authenticated Subscriber can delete arbitrary media attachments, but there is no confidentiality or availability-of-service impact and no remote code execution. Exploitation status is no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC in the provided references (only the Wordfence advisory, WordPress.org trac source lines, and the fixing GitHub PR #4117). The network vector (AV:N) and low complexity (AC:L) are offset by two real gating factors: the attacker must already hold a Subscriber account (PR:L), and the vulnerable code path is only reachable when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's own profile.php. That configuration dependency is not the WordPress/Redux default, so real-world exposure is narrower than the raw network-reachable vector suggests. No signals conflict; the main caveat is that the condition is config-dependent and should be confirmed against the specific site's Redux usage. |
| Exploit ScenarioDerived | An attacker registers or obtains a Subscriber-level account on a WordPress site that runs Redux Framework (≤4.5.14) configured so a Custom Fonts field appears on the user profile page. The attacker reads the redux_custom_fonts nonce rendered into their own wp-admin/profile.php, then submits a request supplying an arbitrary attachment_id, deleting administrator-owned media library files. No public exploit code is known, but the attack is trivial to script once the nonce is observed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets an authenticated subscriber-level user delete arbitrary media library attachments - including files owned by administrators - by supplying an attacker-chosen attachment_id. Exploitation depends on a non-default configuration: a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php and hands the attacker the token needed for the unprotected deletion action. The impact is limited to integrity (deletion of attachments) with no confidentiality exposure or code execution; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 4.5.15.
RemediationAI
Upgrade Redux Framework to 4.5.15, the first vendor-released fixed version, which adds the missing authorization check around the attachment_id parameter (see PR https://github.com/reduxframework/redux-framework/pull/4117/changes and changeset https://plugins.trac.wordpress.org/changeset/3705066/redux-framework/trunk/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php). Because the plugin is frequently embedded in themes and plugins, confirm that every bundled copy of Redux is updated and not merely the standalone plugin. If immediate upgrade is not possible, the most effective compensating control is to remove any Custom Fonts field registered on the user profile page via Redux_Users::set_profile(); without that registration the redux_custom_fonts nonce is not rendered into wp-admin/profile.php and Subscribers cannot obtain the token required to trigger the deletion - the trade-off is loss of the profile-level custom font selection UI for legitimate users. Site operators can additionally minimize subscriber-level accounts and audit or restrict who may register on the site, and should tighten attachment permissions or disable the Custom Fonts extension entirely for low-privileged roles; these reduce exposure but do not eliminate an already-present authorization gap, so patching remains the primary fix. Note that the 4.5.15 release also addresses a separate authenticated (Custom+) stored XSS via the 'user-mediaurl' media field, so updating resolves both issues at once.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Redux Framework is a widely embedded WordPress options/framework library (packaged inside themes and plugins as well as installed as a plugin, hence the CPE cpe:2.3:a:davidanderson:redux_framework:*:*:*:*:*:*:*:*), and the flaw resides in its Custom Fonts extension implemented under redux-core/inc/extensions/custom_fonts/. The root cause is CWE-862 (Missing Authorization): the AJAX/file-handling path that processes the 'attachment_id' parameter for attachment deletion verifies the presence of the redux_custom_fonts nonce but does not perform a capability check to confirm the caller is authorized to delete the referenced attachment, so any user who can obtain that nonce passes the gate. The nonce is normally only present when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(); in that configuration it is rendered into every Subscriber's own wp-admin/profile.php, which converts a Subscriber into a viable attacker and matches the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N vector (low-privilege authenticated, network-reachable, integrity-only). The referenced Trac source links (custom_fonts.php line 57 and class-redux-extension-custom-fonts.php lines 338, 392, 571, 617) pinpoint the vulnerable handling in the 4.5.13/4.5.14 tags, and the upstream fix in PR #4117 / changeset 3705066 adds the missing authorization around the attachment_id parameter.
Know when Redux Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable (AV:N), low complexity (AC:L); requires a Subscriber account (PR:L) and the nonce-exposing profile config; arbitrary attachment deletion is an integrity impact (I:L), no C or A.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Redux Framework
View allPrivilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users t
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowin
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated att
Stored cross-site scripting in the Redux Framework WordPress plugin affects all versions up to and including 4.5.14, let
Exploit-DB