The Redux Framework WordPress plugin before version 4.5.13 does not properly restrict which user meta keys can be written during the saving of custom profile fields. This improper privilege management (CWE-269) enables users with Subscriber-level access to escalate their privileges to Administrator by submitting crafted values while updating their own profile. The vulnerability is specific to sites where the Redux Framework's user-profile feature is enabled. No CVSS score or patch information is currently available.

An attacker with Subscriber role privileges can escalate to Administrator privileges, gaining full control over the WordPress site. This could lead to complete site compromise, including content modification, user management, and potential further exploitation. The impact is significant on affected sites with the vulnerable plugin version and feature enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the Redux Framework user-profile (Users extension) feature if possible or restrict Subscriber role capabilities to limit profile editing. Monitor vendor channels for updates and apply patches promptly once released.