CVE-2026-12525

Name of the Vulnerable Software and Affected Versions Redux Framework WordPress plugin versions prior to 4.5.13

Description When the user-profile (Users extension) feature is enabled, the software fails to restrict which user meta keys can be written during the saving of custom profile fields. This allows authenticated users with the Subscriber role or higher to escalate their privileges to Administrator by submitting a crafted value while updating their own profile.

Recommendations Update the Redux Framework WordPress plugin to version 4.5.13 or later. As a temporary mitigation, disable the user-profile (Users extension) feature.