What is the CVSS score of CVE-2026-7654?

CVE-2026-7654 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Admin Columns are affected by CVE-2026-7654?

The Admin Columns WordPress plugin (versions through 7.0.18) contains a critical code execution flaw allowing any contributor-level user to compromise server integrity without requiring additional…

How to fix or mitigate CVE-2026-7654?

Within 24 hours: Inventory all WordPress installations using Admin Columns plugin (versions ≤7.0.18) and audit active Contributor accounts. Within 7 days: Either uninstall the plugin or immediately restrict Contributor user permissions to exclude post meta editing capabilities. Within 30 days: Monitor Wordfence security feed and official plugin repositories for patch release; upgrade to patched version immediately upon availability or implement alternative column management solutions.

Admin Columns CVE-2026-7654

EUVD-2026-34922 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-05 Wordfence

GHSA-h6x4-229g-5f43

PHP Deserialization WordPress RCE Admin Columns

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 23:15 vuln.today

CVE Published

Jun 05, 2026 - 22:28 nvd

HIGH 8.8

DescriptionCVE.org

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of unserialize() without an allowed_classes restriction in the IdsToCollection::get_ids_from_string() function, which processes attacker-controlled post meta values without proper validation. This makes it possible for authenticated attackers with Contributor-level access and above to inject a serialized PHP object into a post's custom meta field and trigger arbitrary code execution by exploiting a bundled POP gadget chain, resulting in remote code execution as the web server user.

AnalysisAI

Authenticated remote code execution in the Admin Columns WordPress plugin (versions through 7.0.18) allows Contributor-level users to inject serialized PHP objects via post meta and trigger a bundled POP gadget chain through the Laravel SerializableClosure component. Reported by Wordfence with CVSS 8.8, no public exploit identified at time of analysis, though the low privilege barrier and bundled gadget chain make weaponization straightforward for any researcher with plugin access.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data) in the IdsToCollection::get_ids_from_string() function, which invokes PHP's unserialize() on attacker-controlled post meta values without specifying the allowed_classes option - meaning any class loaded in the WordPress runtime can be instantiated during deserialization. The plugin bundles Laravel's serializable-closure library (notably the Native serializer and ClosureStream support class), which provides a ready-made Property-Oriented Programming (POP) gadget chain: a deserialized SerializableClosure can register a stream wrapper that ultimately executes PHP code via include/eval semantics. The affected CPE codepress:admin_columns covers all versions up to and including 7.0.18, and the vulnerable code paths appear in classes/Formatter/IdsToCollection.php and classes/Formatter/Meta.php as referenced in the WordPress plugin trac.

RemediationAI

Upstream fix available (changeset 3553297 in the codepress-admin-columns repository); a released patched version beyond 7.0.18 is not independently confirmed from the provided data, so administrators should upgrade to the latest Admin Columns release published after the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3553297%40codepress-admin-columns&new=3553297%40codepress-admin-columns and verify the IdsToCollection::get_ids_from_string() function now passes allowed_classes=>false to unserialize(). Until upgraded, compensating controls include revoking Contributor and higher roles from untrusted users, restricting post meta write access via a mu-plugin that filters update_post_metadata for keys consumed by Admin Columns formatters (trade-off: may break columns that legitimately store serialized data), and deploying a WAF rule that blocks request bodies containing PHP serialized object markers (O:, C:, or the SerializableClosure class name) in wp-admin post submissions (trade-off: false positives on plugins that legitimately POST serialized data). Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/051a3967-ef86-49bc-b72c-23e43568fef6?source=cve for additional vendor guidance.