Redux Framework EUVD-2025-211057

Exploitation requires three concrete conditions: (1) an authenticated account with at least Subscriber-level access; (2) an active plugin or theme that uses Redux Framework to register a user-profile field via Redux_Users::set_profile/set_section/set_field - this is a non-default integration requirement, not a core plugin feature, and is the primary limiting factor; and (3) a profile-update action through which arbitrary meta keys can be saved under the registered option name without capability checks or a key allowlist. The vulnerability is network-reachable and needs no user interaction from a victim, but the absence of the required profile-field integration makes a given site non-exploitable even with the plugin installed.

This is a credible but conditional privilege-escalation issue (CWE-269) rather than a drop-everything emergency. The input CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, 6.8 Medium) is internally consistent with the description: AV:N reflects exploitation over an HTTP profile-update request, PR:L matches the stated Subscriber-level-and-above requirement, and AC:H reflects the key precondition that a plugin or theme built on Redux Framework must have registered at least one user-profile field via Redux_Users::set_profile/set_section/set_field. No EPSS score, KEV entry, or SSVC decision data was supplied, and no public exploit identified at time of analysis. Because Redux Framework is a developer library embedded in other themes/plugins rather than an end-user feature, actual exploitability depends on the downstream integration, so the real-world risk is narrower than the C:H/I:H impact alone suggests - but where the vulnerable profile-field pattern is present, a low-privileged user can escalate to Administrator, which is a full site-compromise outcome. Net: a genuine priority on sites that both run the plugin and expose a Redux-backed user-profile field, and a lower priority elsewhere. Note A:N in the supplied vector is arguably understated, since gaining the Administrator role yields full availability control as well.

An attacker registers or already holds a Subscriber-level account on a WordPress site whose active theme or plugin uses Redux Framework to add a user-profile field. They submit a crafted profile-update request that writes an arbitrary meta key (such as the site's capabilities/role meta) under the plugin's registered option name, assigning themselves the Administrator role and taking over the site. No public exploit code was identified at time of analysis.