CVE-2026-88999: Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via ReduxUsers::setprofile(), as doing so causes the required reduxcustomfonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker can delete arbitrary media library attachments, including files owned by administrators.
Is every site using an affected version exposed by default?
Exploitation requires a Custom Fonts field to be registered on the user profile page through Redux_Users::set_profile(). This condition renders the required redux_custom_fonts nonce on a Subscriber's wp-admin/profile.php page.
What does an attacker need to delete attachments?
The attacker needs a valid authenticated account at Subscriber level or above and access to the required redux_custom_fonts nonce exposed on their profile page when the specified Custom Fonts configuration is present. No user interaction is required.