The Redux Framework plugin introduced a missing authorization check that allows any authenticated user with subscriber level permissions or higher to call an import/export AJAX action and retrieve the entire Redux options panel configuration. This panel can contain sensitive data such as API keys, SMTP credentials, licence keys, and third‑party tokens, enabling an attacker to exfiltrate confidential settings.

All WordPress sites running Redux Framework 4.5.16 or earlier are vulnerable, especially those that use themes or plugins that register a Redux import_export field on user profiles via Redux_Users::set_profile(). The flaw is triggered when a subscriber opens their own /wp-admin/profile.php page, which includes a nonce injected into the page source and can be exploited locally.

The vulnerability is scored 5.3 on CVSS, indicating moderate severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. It can be exploited by any authenticated user without needing external network access, and once the configuration is exported the attacker gains a full dump of private settings that can aid further attacks.