CVE-2026-88999 davidanderson CVE debrief

Who should care

Defenders responsible for WordPress sites using the Redux Framework plugin should assess exposure and apply patches. Site administrators and security teams should verify the version of the plugin and restrict access to media library attachments for low-privileged users.

Why it matters

The Redux Framework plugin for WordPress has an authorization bypass vulnerability allowing subscribers to delete arbitrary media library attachments. Defenders should verify exposure, apply patches, and restrict access to media library attachments for low-privileged users.

• Potential unauthorized deletion of media library attachments
• Possible disruption to site content and functionality
• Need for verification of plugin version and exposure
• Priority for applying patches or mitigations

Technical summary

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to the potential for unauthorized media deletion.

Recommended defensive actions

• Verify the version of Redux Framework plugin and update to a patched version if necessary
• Restrict access to media library attachments for subscribers and other low-privileged users
• Monitor for unauthorized media deletions
• Implement additional logging and monitoring for media library access
• Conduct regular security audits to identify potential vulnerabilities
• Review and update incident response plans to address potential exploitation
• Ensure that all users with access to the media library have the appropriate permissions

Evidence notes

The vulnerability is due to improper authorization checks in the Redux Framework plugin. An attacker with subscriber-level access can delete media library attachments by exploiting this issue when a Custom Fonts field is registered on the user profile page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.