CVE-2026-88999

MediumCVSS 4.3

Published: 01/10/2026(UTC)Updated: 03/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to delete arbitrary media library attachments, including administrator-owned files, when a Custom Fonts field is registered on the user profile page.

Risk Assessment

Attackers can delete important files, including administrator-owned ones, leading to data loss and site disruption. The risk affects the integrity and availability of resources.

Recommendation

Update the Redux Framework plugin to a version later than 4.5.14. It is also recommended to check whether any unauthorized file deletion occurred.

Other vulnerabilities in Redux Framework WordPress plugin

CVE-2026-102918Medium
The Redux Framework plugin for WordPress (versions up to and including 4.5.15) is vulnerable to stored cross-site scripting via the multi_media field. The field's renderer prints the stored value into an href attribute, a hidden input value, and an HTML element without escaping, and user_meta_save() checks permissions against a user ID from the request body, allowing a Subscriber to write a field declared for manage_options. An authenticated attacker with Subscriber-level access can inject arbitrary scripts into their own profile that execute when an administrator views that profile.

Original NVD description (English source)

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS