Redux Framework CVE-2026-12525

Exploitation requires two concrete prerequisites: (1) the attacker must hold at least a Subscriber-role account on the target site (PR:L in the CVSS vector confirms low-privilege authentication is required, so open user registration or any existing low-tier account enables this), and (2) the site must have the Redux Framework plugin's Users extension / user-profile custom-fields feature explicitly enabled - sites running the plugin without this feature are not exploitable. The specific mechanism is the unrestricted writing of user meta keys (notably wp_capabilities) via the custom profile-field save handler. Limiting factors: no exploitation against fully default/anonymous configurations (an account is needed), the non-default Users extension must be active, and the plugin version must be before 4.5.13.

The signals are moderately consistent but not alarmist. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8 High) indicates a network-exploitable, low-complexity attack requiring only low privileges (an existing Subscriber account) and no user interaction, with total impact - matching the SSVC Technical Impact rating of 'total'. However, SSVC also rates Exploitation as 'none' (no observed exploitation) and Automatable as 'no', and EPSS is very low at 0.14% (4th percentile), indicating no widespread automated exploitation is currently predicted. The key limiting factors are that the attacker must already hold a Subscriber (or higher) account AND the site must have the plugin's Users extension / user-profile feature explicitly enabled, which is not a universal default. This is a genuine privilege-escalation risk worth prompt patching on affected sites, especially those allowing open user registration, but it is not a mass-exploited internet-wide event - the low EPSS despite a public POC suggests conditional, targeted applicability rather than commodity scanning.

An attacker registers or obtains a Subscriber-level account on a WordPress site running a vulnerable Redux Framework version with the Users extension enabled. They edit their own profile and submit a crafted custom-field value that writes the wp_capabilities user meta key, granting themselves the administrator role, then log back in with full control of the site. A public exploit/advisory from WPScan documents this technique, and the low attack complexity (AC:L) and lack of required user interaction make it straightforward to reproduce.