Vulnerabilities / Redux Framework / WPSEC-2026-0909
Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Missing Authorization to Restricted Profile Field Update via 'checkuser_id' Parameter
Medium 4.3
CWE-639Fixed in 4.5.16
- ID
- WPSEC-2026-0909
- Plugin
- Redux Framework (redux-framework)
- Affected
- from 4.4.1 before 4.5.16
- Remediation
- Update to 4.5.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Redux Framework on WPSec AttackSurface
- Fix released
- Published
Description
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15 due to the user profile field save routine checking field-level permissions against a user ID taken from the client-supplied 'checkuser_id' parameter instead of the current user. This makes it possible for authenticated attackers with Subscriber-level access and above to supply an administrator's user ID and save values to permission-restricted Redux profile fields that they should not be able to modify.
References
- https://wpsec.com/vuln/WPSEC-2026-0909/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.16/
- https://wordpress.org/plugins/redux-framework/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS