The Redux Framework plugin for WordPress up to version 4.5.16 contains an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to export the entire Redux options panel configuration, including sensitive data such as API keys and credentials. Exploitation requires a theme or plugin to register a Redux import_export field on a user profile, exposing a nonce in the subscriber's profile page source, which can be read without additional privileges.