CVE-2025-14123: CWE-269 Improper Privilege Management in davidanderson Redux Framework

CVE-2025-14123 describes an improper privilege management vulnerability (CWE-269) in the Redux Framework WordPress plugin. Versions up to and including 4.5.11 allow authenticated users with Subscriber-level privileges or above to escalate their privileges by setting arbitrary user roles during profile updates. This occurs because the plugin saves arbitrary meta keys under a registered option name without enforcing capability checks or key allowlisting. Exploitation requires that a plugin or theme using this framework has added at least one user profile field leveraging Redux_Users::set_profile, set_section, or set_field methods.

Successful exploitation allows an authenticated low-privilege user to escalate their privileges to Administrator, leading to full control over the WordPress site. This compromises confidentiality and integrity of the site content and configuration. Availability impact is not indicated. No known exploits in the wild have been reported.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict access to trusted users only and avoid installing plugins or themes that add user profile fields using Redux_Users methods. Applying the principle of least privilege and disabling unnecessary user profile modifications can reduce risk.