Redux Framework, CVE-2025-14123

CVE, Research URL: CVE-2025-14123
Home page URL: Security reports for Redux Framework
Application: Redux Framework
Published on: Oct 09, 2026
Research Description: The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.
Affected versions: max 4.5.13.
Status: vulnerable