CVE-2026-7654

Vulnerability

The Admin Columns plugin for WordPress versions up to and including 7.0.18 is vulnerable to PHP Object Injection. This vulnerability exists in the IdsToCollection::get_ids_from_string() function, which processes post meta values. The function uses unserialize() without an allowed_classes restriction on attacker-controlled input, enabling the injection of serialized PHP objects [3].

Exploitation

An authenticated attacker with Contributor-level access or higher can exploit this vulnerability. The attacker needs to inject a serialized PHP object into a post's custom meta field. When this meta field is processed by the vulnerable function, it can trigger a bundled POP gadget chain, leading to arbitrary code execution [3].

Impact

Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) as the web server user. This means the attacker can execute arbitrary code on the server, potentially leading to a full compromise of the WordPress installation and the underlying server.

Mitigation

This vulnerability was fixed in Admin Columns version 7.0.19. There are no other workarounds available. Users are strongly advised to update to a patched version as soon as possible. The plugin is not listed on the Known Exploited Vulnerabilities (KEV) catalog at this time.