CVE-2026-7654

Name of the Vulnerable Software and Affected Versions Admin Columns versions prior to 7.0.19

Description The plugin is subject to PHP Object Injection, which can lead to Remote Code Execution. This occurs because the get ids from string() function in the IdsToCollection class uses unserialize() without restricting allowed classes when processing post meta values. Authenticated attackers with Contributor-level access or higher can inject a serialized PHP object into a post's custom meta field. By exploiting a bundled POP gadget chain—a sequence of existing code snippets that can be chained together during deserialization—the attacker can execute arbitrary code as the web server user.

Recommendations Update to a version later than 7.0.18. As a temporary workaround, restrict access to post custom meta fields for users with Contributor-level permissions to prevent the injection of serialized objects into the get ids from string() function.