EUVD-2026-44875
GHSA-xfrq-p2m8-qpvm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exploitable via profile save (AV:N), no special conditions beyond a low-privilege Subscriber account (PR:L), no interaction (UI:N); admin takeover yields total C/I/A impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enabled.
AnalysisAI
Privilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users to become Administrators by writing arbitrary user meta keys through the plugin's custom profile fields, on sites where the Users extension (user-profile feature) is enabled. Because the plugin does not restrict which user meta keys are written when saving custom profile fields, an attacker can inject the wp_capabilities meta to grant themselves the administrator role. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.14% and there is no evidence of active exploitation.
Technical ContextAI
Redux Framework is a widely used WordPress options/settings framework bundled by many themes and plugins; the vulnerability lies specifically in its Users extension, which exposes custom fields on the WordPress user-profile edit screen. When a user saves their own profile, the plugin persists these custom fields as user meta via WordPress's update_user_meta mechanism but fails to enforce an allowlist of permitted meta keys. This is CWE-269 (Improper Privilege Management): because WordPress stores a user's role and capabilities in the wp_capabilities user meta key (prefixed by the table prefix), an unrestricted meta write lets a low-privileged account overwrite its own role assignment. The CPE (cpe:2.3:a:unknown:redux_framework) reflects the plugin as the affected component, with the vendor field unresolved in NVD data.
RemediationAI
Vendor-released patch: upgrade the Redux Framework plugin to version 4.5.13 or later, which restricts writable user meta keys when saving custom profile fields. If immediate patching is not possible, apply compensating controls: disable the plugin's Users extension / user-profile feature (this removes the vulnerable code path entirely, at the cost of losing custom profile-field functionality), and tighten user registration by disabling open self-registration (Settings > General > 'Anyone can register') so attackers cannot obtain the Subscriber account required for exploitation. Additionally, audit the wp_usermeta table for unexpected wp_capabilities changes and unexpected administrator accounts. Refer to the WPScan advisory (https://wpscan.com/vulnerability/11d5d4c2-7ba9-4389-9050-28c90920e34b/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-12525) for details.
More in Redux Framework
View allSame weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today