Executive brief
A vulnerability in the Redux Framework plugin for WordPress allows low-level users, such as subscribers, to grant themselves administrative control over a website. This occurs because the plugin fails to properly verify which profile settings a user is allowed to change. If exploited, an attacker can take full control of the site, potentially leading to data theft, site defacement, or complete service disruption.
Technical details
The Redux Framework plugin for WordPress (specifically the 'Users' extension) contains a privilege escalation vulnerability due to insufficient validation of user meta keys during profile updates. The software fails to restrict which meta keys can be written when saving custom profile fields. An authenticated attacker with at least Subscriber-level privileges can submit a crafted request to update their own profile with administrative meta keys (e.g., wp_capabilities), effectively granting themselves Administrator access. This vulnerability is present in versions prior to 4.5.13 and requires the 'user-profile' feature to be enabled. A fix is available in version 4.5.13.
Affected products
- Redux.io Redux Framework < 4.5.13
Timeline
- 2026-06-25: disclosed: Initial public disclosure via WPScan
- 2026-06-25: patched: Fix released in version 4.5.13
- 2026-07-16: advisory: NVD entry published