CVE-2026-7654
PHP Object Injection in Admin Columns WordPress Plugin
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_admin_columns | admin_columns | to 7.0.18 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Admin Columns plugin for WordPress has a vulnerability in versions up to and including 7.0.18 where it improperly uses the PHP function `unserialize()` without restricting allowed classes. This occurs in the `IdsToCollection::get_ids_from_string()` function, which processes post meta values that can be controlled by an attacker.
Because of this, an authenticated attacker with Contributor-level access or higher can inject a malicious serialized PHP object into a post's custom meta field. This injection exploits a gadget chain within the plugin to execute arbitrary code remotely on the web server.
How can this vulnerability impact me? :
This vulnerability can lead to remote code execution on the web server running the WordPress site. An attacker with Contributor-level access or higher can execute arbitrary code, potentially taking full control of the server environment under the web server user privileges.
The impact includes complete compromise of the affected website, data theft, defacement, installation of malware, or use of the server for further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Admin Columns plugin for WordPress to a version later than 7.0.18 where the issue is fixed.
Additionally, restrict Contributor-level users from adding or modifying post meta fields if possible, as the vulnerability requires authenticated users with Contributor-level access or higher.
Consider applying web application firewall (WAF) rules to detect and block attempts to inject serialized PHP objects in post meta fields.