medium6.5
CVE-2026-18943
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscri…
Impact
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.
Affected products
| Product | Affected versions |
|---|---|
| WPC Admin Columns WordPress Plugin | before 2.3.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.