Description

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-10-09T08:16:54.090Z",
  "pubdate": "2026-10-09T08:16:54.090Z",
  "executiveSummary": "The Redux Framework plugin for WordPress, in versions up to and including 4.5.11, contains a critical security vulnerability related to insufficient input validation during profile update operations.\nThis vulnerability is classified as an improper authorization flaw, specifically enabling unauthorized privilege escalation.\nThe flaw stems from the plugin's failure to adequately restrict the saving of arbitrary user meta keys when processing profile updates via the Redux_Users component.\nBy manipulating the request parameters, an authenticated attacker with minimal privileges (such as a Subscriber) can inject malicious metadata keys into the WordPress user database.\nThis mechanism allows an attacker to modify their own user role to an administrative level, effectively bypassing WordPress core capability checks.\nThe risk implication is total site compromise, as administrative access provides full control over the WordPress installation, including theme and plugin manipulation, data exfiltration, and arbitrary code execution capabilities.\nSuccessful exploitation requires the presence of a theme or plugin that actively utilizes Redux_Users::set_profile, set_section, or set_field functions, which are common within the framework's implementation in third-party products.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of user metadata updates within the Redux Framework's internal processing logic for user profile fields.\nSpecifically, the functions Redux_Users::set_profile, Redux_Users::set_section, and Redux_Users::set_field facilitate the storage of user-defined data into the 'wp_usermeta' table without enforcing a strict allowlist of permissible keys.\nIn the affected versions, the framework accepts arbitrary meta keys transmitted via HTTP requests and persists them to the database under the user's ID without verifying if the requesting user possesses sufficient capabilities to modify those specific fields.\nWhen a plugin or theme registers custom user profile fields using the Redux Framework, it creates a conduit for data input that is subsequently processed by these vulnerable methods.\nAn authenticated attacker initiates the attack by crafting a POST request to the profile update endpoint, including a parameter corresponding to a meta key that dictates the user role (typically 'wp_capabilities' or 'wp_user_level').\nBecause the framework lacks an allowlist validation mechanism, it fails to filter out sensitive keys that are intended to be managed solely by system administrators.\nThe execution flow proceeds as follows: 1) The attacker targets an endpoint handled by Redux Framework. 2) The malicious payload is injected into the request, targeting user meta fields. 3) The backend logic invokes the Redux_Users methods, which process the input as legitimate user meta data. 4) The application calls native WordPress functions (such as update_user_meta) using the attacker-supplied, unsanitized keys.\nThis results in the modification of the attacker's 'wp_capabilities' entry in the database. Since WordPress relies on these meta keys to define user permissions, the successful injection immediately elevates the attacker's account to the Administrator role.\nPost-exploitation, the attacker gains full administrative control over the application, which may be leveraged to install malicious plugins, modify configuration files, or compromise the underlying server environment."
}