# CVE-2025-14123: Redux Framework privilege escalation in user profile update

Source: https://junglewise.ai/threats/cve-2025-14123-the-redux-framework-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2025-14123 · Severity: medium · CVSS 6.8 · Published 2026-10-09

Redux Framework is a plugin library used by WordPress plugins and themes to manage settings and user profiles. The vulnerability allows any authenticated user with basic access to escalate their account to an administrator by manipulating profile fields, potentially gaining full control of the WordPress site.

Technologies: [Redux Framework](https://junglewise.ai/threats/technologies/redux-redux-framework). Vendors: [Redux](https://junglewise.ai/threats/vendors/redux).

## Quick answers

**Is CVE-2025-14123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14123 being exploited in the wild.

**How severe is CVE-2025-14123?** Medium severity, with a CVSS score of 6.8, published 9 October 2026.

**Which products and versions are affected?** Redux Framework up to 4.5.11.

**Is there a fix for CVE-2025-14123?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-14123 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-14123?** Check whether you run Redux Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation flaw exists in Redux Framework versions up to 4.5.11 where the Redux_Users class fails to validate or restrict arbitrary meta keys saved during user profile updates. An authenticated attacker with Subscriber role or higher can inject an arbitrary role (such as Administrator) into user metadata by submitting a crafted profile update, provided a theme or plugin using Redux has registered at least one custom user profile field.

## Affected products

- Redux Redux Framework up to 4.5.11

## Timeline

- 2025-10-09: disclosed

## References

- [https://plugins.trac.wordpress.org/changeset/3582185/redux-framework](https://plugins.trac.wordpress.org/changeset/3582185/redux-framework)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe52266-9ee1-47a8-a6df-7057b29e8098?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe52266-9ee1-47a8-a6df-7057b29e8098?source=cve)

## Related threats

- [Redux Framework authorization bypass in import/export](https://junglewise.ai/threats/cve-2026-110705-the-redux-framework-plugin-for-wordpress-is-vulnerable-to)
- [Redux Framework stored cross-site scripting in multi_media field](https://junglewise.ai/threats/cve-2026-102918-the-redux-framework-plugin-for-wordpress-is-vulnerable-to-stored)
- [Redux Framework plugin WordPress stored XSS in spinner field](https://junglewise.ai/threats/cve-2026-5410-the-redux-framework-plugin-for-wordpress-is-vulnerable-to-stored)