Wpc Admin Columns
Monthly
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.