EUVD-2026-57103
GHSA-g4v7-86p8-gx99
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AJAX endpoint is network-reachable requiring only subscriber authentication (PR:L); no integrity or availability impact; confidentiality is High due to unrestricted metadata read across all users including admins.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.
AnalysisAI
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.
Technical ContextAI
WPC Admin Columns is a WordPress plugin that customizes post list columns in the admin interface. WordPress plugins register AJAX handlers via wp_ajax_ hooks and are responsible for explicitly verifying caller permissions using current_user_can() or equivalent capability checks. This flaw (CWE-200: Exposure of Sensitive Information) arises because one registered AJAX action omits this check entirely, allowing any authenticated WordPress session - regardless of role - to invoke the handler. WordPress metadata (user meta, post meta, term meta) can contain sensitive values such as email addresses, API keys stored in custom fields, session tokens, or plugin-specific configuration data. The affected CPE is cpe:2.3:a:unknown:wpc_admin_columns:*:*:*:*:*:*:*:* covering all versions prior to 2.3.4.
RemediationAI
Upgrade WPC Admin Columns to version 2.3.4 or later, which introduces proper authorization checks on the affected AJAX endpoint - this is the primary and confirmed fix. Until the upgrade is applied, administrators should disable open user registration (Settings > General > Membership) to prevent unauthenticated actors from self-provisioning subscriber accounts, though this does not protect against existing subscriber accounts. A WAF rule blocking unauthenticated or low-privileged access to specific admin-ajax.php action parameters associated with this plugin can serve as a compensating control but may break legitimate plugin functionality and requires knowing the specific action name. Auditing subscriber-level accounts for legitimacy is advisable on multi-user sites. The WPScan advisory (https://wpscan.com/vulnerability/9f2f3db0-1031-4e16-96f2-12a02b97ad06/) and VulDB entry (https://vuldb.com/vuln/388958) provide additional remediation context.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today