7 matches found
CVE-2026-103997
The Redux Framework plugin for WordPress (versions up to and including 4.5.15 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows authenticated attackers with subscriber-level access or higher to access the entire Redux options payload...
CVE-2026-103997 Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2025-14123 Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it...
CVE-2025-14123 Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it...
CVE-2025-14123
The Redux Framework plugin for WordPress (versions up to and including 4.5.11 ) is vulnerable to privilege escalation . The root cause is the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist restrictions. This allows authentica...
CVE-2026-12525
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile...
