CubeWP Framework < 1.1.25 - Subscriber+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation due to the plugin not properly restricting user meta key updates through the cwp_save_user_fields() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.