CVE-2026-88999: Redux Framework WordPress Auth Bypass

CVE-2026-88999 Overview

The Redux Framework plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 4.5.14. The plugin fails to properly verify that a user is authorized to perform media library actions. Authenticated attackers with subscriber-level access can delete arbitrary media library attachments, including administrator-owned files. The flaw is exploitable when a Custom Fonts field is registered on the user profile page through Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to render into the Subscriber's wp-admin/profile.php page. This vulnerability is tracked as a Missing Authorization issue under [CWE-862].

Critical Impact

Subscriber-level users can delete arbitrary media library attachments across the WordPress site, including files owned by administrators.

Affected Products

• Redux Framework plugin for WordPress — all versions up to and including 4.5.14
• WordPress sites where a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile()
• Sites exposing the redux_custom_fonts nonce to low-privileged users

Discovery Timeline

• 2026-10-01 - CVE-2026-88999 published to NVD
• 2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-88999

Vulnerability Analysis

The Redux Framework plugin ships a Custom Fonts extension that handles media attachment operations through authenticated AJAX endpoints. These handlers verify a nonce but do not perform a capability check to confirm the acting user has permission to delete the targeted attachment. Any authenticated user whose profile page renders the redux_custom_fonts nonce can therefore invoke the delete action against arbitrary attachment IDs. Because Subscribers are the lowest privilege tier in WordPress, the bypass expands the attack surface to any logged-in user on a site that uses the Custom Fonts feature on user profiles. Deletion of administrator-owned media files can break site layout, remove evidence, or support follow-on social engineering.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Custom Fonts extension handlers located in redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php. The handlers at lines 338, 392, 571, and 617 of the 4.5.13 and 4.5.14 branches rely on nonce verification as the sole access control. Nonces prove request intent but do not establish privilege, so a Subscriber who legitimately holds the redux_custom_fonts nonce can call the attachment deletion path unrestricted.

Attack Vector

An authenticated Subscriber loads wp-admin/profile.php on a site where Redux_Users::set_profile() registers a Custom Fonts field. The response contains the redux_custom_fonts nonce needed to pass the plugin's internal verification. The attacker then issues an authenticated AJAX request to the Custom Fonts delete endpoint, supplying an arbitrary WordPress attachment ID. Because no current_user_can() or ownership check is applied, the server removes the targeted media file. The attack requires only network access to the login page and valid Subscriber credentials.

No verified proof-of-concept code is publicly listed. See the Wordfence Vulnerability Analysis and the GitHub Pull Request Changes for the vulnerable call paths and the applied fix.

Detection Methods for CVE-2026-88999

Indicators of Compromise

• Unexpected wp-admin/admin-ajax.php POST requests from Subscriber accounts targeting Redux Custom Fonts actions.
• WordPress media library entries disappearing without a corresponding administrator action in the audit log.
• Access log entries where low-privilege sessions reference the redux_custom_fonts nonce outside normal font-management workflows.

Detection Strategies

• Review web server and WordPress audit logs for AJAX calls to Redux Custom Fonts endpoints originating from non-administrator sessions.
• Correlate attachment deletion events in the wp_posts table (post_type attachment) with the acting user ID and role at the time of deletion.
• Deploy a WordPress security plugin or web application firewall rule that flags attachment deletion requests from users lacking the delete_posts capability for the target object.

Monitoring Recommendations

• Continuously monitor the installed version of Redux Framework across all WordPress properties and alert on versions at or below 4.5.14.
• Baseline normal media library change rates and alert on bulk attachment deletions, especially from freshly registered accounts.
• Track creation of new Subscriber accounts followed by rapid activity against admin-ajax.php endpoints.

How to Mitigate CVE-2026-88999

Immediate Actions Required

• Upgrade the Redux Framework plugin to a version later than 4.5.14 that includes the fix delivered in WordPress Changeset 3705066.
• Audit the WordPress media library against recent backups to identify and restore attachments deleted without authorization.
• Review Subscriber-tier accounts for suspicious registration patterns and disable or purge accounts not tied to legitimate users.

Patch Information

The fix is published in the Redux Framework trunk under WordPress Changeset 3705066 and the corresponding GitHub Pull Request Changes. The patch adds proper capability checks to the Custom Fonts attachment handlers in class-redux-extension-custom-fonts.php so that nonce possession alone no longer authorizes deletion. Site operators should apply the plugin update through the WordPress admin or wp-cli as soon as it is available in the plugin repository.

Workarounds

• Remove or disable any theme or plugin code that calls Redux_Users::set_profile() to register a Custom Fonts field on user profile pages, which prevents the redux_custom_fonts nonce from being exposed to Subscribers.
• Restrict new user registration or set the default role to a value other than Subscriber until the plugin is upgraded.
• Deploy a web application firewall rule that blocks Redux Custom Fonts AJAX actions from sessions without the upload_files or delete_posts capability.

# Update Redux Framework via wp-cli once the fixed version is published
wp plugin update redux-framework
wp plugin get redux-framework --field=version