The Redux Framework plugin for WordPress up to version 4.5.15 suffers from an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to view sensitive configuration data, including plaintext passwords, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript on the wp-admin/profile.php page. The vulnerability arises because the plugin does not properly verify user authorization for certain actions. The Users extension, which is automatically loaded for every Redux instance, causes all sites using Redux Framework to be affected regardless of explicit configuration.