株式会社mgn@mgn_jpn
🛠 Redux Framework の脆弱性が修正されました（深刻度 中） 90万サイト以上が利用 / CVSS 6.8 4.5.13 に更新してください https://shindan.m-g-n.me/alerts/cve-2025-14123/
00000116
396 followersView on X
CVE-2025-14123
LOWCVSS 6.8 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-269
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
By indicator