CVE-2026-18943
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WPC Admin Columns WordPress plugin before 2.3.4 lacks authorization checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post, and term metadata, including data belonging to administrators.
Risk Assessment
An attacker can access sensitive data such as administrator metadata, potentially leading to privilege escalation or privacy breach.
Recommendation
Update the WPC Admin Columns plugin to version 2.3.4 or later. Restrict AJAX actions to authorized users only.
Original NVD description (English source)
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.