Missing authorization in the Redux Framework plugin allows an attacker to read sensitive data embedded in the cache. The vulnerability enables the disclosure of private configuration information or user data that is stored by the plugin, thereby violating the confidentiality of the site. Because no input filtering or authentication check is performed, the flaw can be leveraged by anyone who can reach the affected endpoint.

WordPress sites that use the Redux Framework plugin version 4.5.16 or earlier. The affected component is the Redux Framework plugin maintained by David Anderson, which is part of many WordPress installations.

The CVSS score of 6.5 indicates a moderate level of severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, as the flaw involves a web-accessible endpoint that lacks proper access control. Exploiting the vulnerability does not require special privileges beyond the ability to send HTTP requests to the target site, and it can result in the exposure of cached data across the authenticated user base.