Vulnerability · Published Jul 16, 2026 · Assigned by WPScan

CVE-2026-12525Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator

High 8.8

In plain English

A high-severity privilege mismanagement in Redux Framework from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 63.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enabled.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Redux Framework	0 – before 4.5.13

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/11d5d4c2-7ba9-4389-9050-28c90920e34b/ exploit, vdb-entry, technical-description