Redux Framework WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Redux Framework WordPress plugin, affecting versions prior to 4.5.13. The issue arises because the plugin does not properly restrict which user meta keys can be written when saving custom profile fields. This flaw allows users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile. The vulnerability is present on sites where the plugin's user-profile feature is enabled.

Impact

Exploitation of this vulnerability allows users with the Subscriber role to gain Administrator privileges.

Remediation

Users are advised to update the Redux Framework WordPress plugin to version 4.5.13 or later.