CVE-2026-88999: CWE-862 Missing Authorization in davidanderson Redux Framework
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
AI Analysis
Technical Summary
CVE-2026-88999 is an authorization bypass vulnerability in the Redux Framework WordPress plugin (versions up to and including 4.5.14). The flaw arises from improper authorization checks allowing authenticated users with subscriber-level privileges or higher to delete arbitrary media library attachments. Exploitation requires that a Custom Fonts field be registered on the user profile page via Redux_Users::set_profile(), which causes the redux_custom_fonts nonce to be rendered in the subscriber's wp-admin/profile.php page, enabling the bypass.
Potential Impact
An attacker with subscriber-level access can delete arbitrary media library attachments, including files owned by administrators. This results in integrity loss of media content but does not impact confidentiality or availability according to the CVSS vector.
Mitigation Recommendations
No explicit patch or fix is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access or disable the Custom Fonts field registration if possible to reduce risk.
CVE-2026-88999: CWE-862 Missing Authorization in davidanderson Redux Framework
Description
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
CVSS v3.1
Score 4.3medium
Affected software
davidanderson
Redux Framework
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88999 is an authorization bypass vulnerability in the Redux Framework WordPress plugin (versions up to and including 4.5.14). The flaw arises from improper authorization checks allowing authenticated users with subscriber-level privileges or higher to delete arbitrary media library attachments. Exploitation requires that a Custom Fonts field be registered on the user profile page via Redux_Users::set_profile(), which causes the redux_custom_fonts nonce to be rendered in the subscriber's wp-admin/profile.php page, enabling the bypass.
Potential Impact
An attacker with subscriber-level access can delete arbitrary media library attachments, including files owned by administrators. This results in integrity loss of media content but does not impact confidentiality or availability according to the CVSS vector.
Mitigation Recommendations
No explicit patch or fix is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access or disable the Custom Fonts field registration if possible to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-10T16:15:30.715Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abe749ea43b0b3b89bd1d65
Added to database: 10/01/2026, 14:56:30 UTC
Last enriched: 10/01/2026, 15:28:34 UTC
Last updated: 10/02/2026, 03:53:34 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.