Subscriber-to-Administrator escalation via unrestricted user meta writes

Privilege escalation in Redux Framework before 4.5.13 allows remote authenticated users to gain Administrator access through profile updates. The Users extension accepts attacker-supplied profile field keys and writes them as user metadata without restricting the reserved wp_capabilities key. Subscriber access and an enabled user-profile configuration are required; a crafted self-profile update replaces the account's capabilities with the Administrator role.