{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-88999","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-09-10T16:15:30.715Z","datePublished":"2026-10-01T05:30:55.556Z","dateUpdated":"2026-10-03T15:42:52.610Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-01T05:30:55.556Z"},"affected":[{"vendor":"davidanderson","product":"Redux Framework","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.5.14","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page."}],"title":"Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7e24790-01a0-41bc-a380-60d86c6e1443?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/custom_fonts/class-redux-custom-fonts.php#L57"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L338"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L392"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L617"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L571"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L617"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L338"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L392"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/custom_fonts/class-redux-custom-fonts.php#L57"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L571"},{"url":"https://github.com/reduxframework/redux-framework/pull/4117/changes"},{"url":"https://plugins.trac.wordpress.org/changeset/3705066/redux-framework/trunk/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-862 Missing Authorization","cweId":"CWE-862","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM"}}],"credits":[{"lang":"en","type":"finder","value":"Eunho Kim"}],"timeline":[{"time":"2026-09-10T16:30:36.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-09-30T16:41:29.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88999","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-03T15:29:33.178456Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-03T15:42:52.610Z"}}]}}