CVE-2026-18943 — WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure

CVE-2026-18943

WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure PUBLISHED

Description (CNA)

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.

Affected (CNA)

Vendor / product	Versions
Unknown / WPC Admin Columns	affected 0 before 2.3.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9f2f3db0-1031-4e16-96f2-12a02b97ad06/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.