CVE-2025-14123

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3582185/redux-framework
https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe52266-9ee1-47a8-a6df-7057b29e8098?source=cve

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El plugin Redux Framework para WordPress es vulnerable a escalada de privilegios en todas las versiones anteriores o iguales a 4.5.11. Esto se debe a que el plugin guarda claves meta arbitrarias bajo un nombre de opción registrado sin realizar comprobaciones de privilegios suficientes ni aplicar una lista de permitidos o restricciones para las claves. Esta vulnerabilidad permite que atacantes autenticados, con acceso de nivel Suscriptor o superior, establezcan un rol arbitrario (por ejemplo, Administrador) al realizar una actualización de perfil si un plugin o tema que utiliza este framework ha añadido al menos un campo de perfil de usuario que emplea Redux_Users::set_profile/set_section/set_field.

09 Oct 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-09 08:16

Updated : 2026-10-19 22:10

NVD link : CVE-2025-14123

Mitre link : CVE-2025-14123

CVE.ORG link : CVE-2025-14123

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2025-14123", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14123", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-11T16:38:43.087941Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "davidanderson", "product": "Redux Framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.5.11"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-09T08:16:54.090", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3582185/redux-framework", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe52266-9ee1-47a8-a6df-7057b29e8098?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field."}, {"lang": "es", "value": "El plugin Redux Framework para WordPress es vulnerable a escalada de privilegios en todas las versiones anteriores o iguales a 4.5.11. Esto se debe a que el plugin guarda claves meta arbitrarias bajo un nombre de opci\u00f3n registrado sin realizar comprobaciones de privilegios suficientes ni aplicar una lista de permitidos o restricciones para las claves. Esta vulnerabilidad permite que atacantes autenticados, con acceso de nivel Suscriptor o superior, establezcan un rol arbitrario (por ejemplo, Administrador) al realizar una actualizaci\u00f3n de perfil si un plugin o tema que utiliza este framework ha a\u00f1adido al menos un campo de perfil de usuario que emplea Redux_Users::set_profile/set_section/set_field."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "security@wordfence.com"}