CVE-2026-12525
High
Description
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enabled.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Redux Framework
PublishedJul 16, 2026
First seenJul 16, 2026
Weakness typeCWE-269Improper privilege management
How to fix
Update
- Redux Framework4.5.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Redux Framework | v < 4.5.13 | 4.5.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.