Description

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T06:20:46.903Z",
  "pubdate": "2026-08-12T06:20:46.903Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the WPC Admin Columns WordPress plugin prior to version 2.3.4, specifically residing in an unauthenticated or insufficiently restricted AJAX action handler.\nThis security flaw enables low-privileged authenticated actors, specifically users assigned the subscriber role, to arbitrarily query and read sensitive metadata associated with users, posts, and taxonomy terms.\nThe inherent risk encompasses the potential disclosure of confidential information belonging to higher-privileged accounts, including site administrators, which may facilitate further privilege escalation or targeted attacks.\nExploitation of this vulnerability requires network access to the target WordPress instance and a valid subscriber-level session, but does not necessitate complex administrative pre-requisites due to the absence of proper capability checks within the vulnerable AJAX endpoint.",
  "technicalDetails": "The vulnerability stems from the absence of proper authorization and capability verification mechanisms within one of the AJAX action handlers implemented by the WPC Admin Columns plugin.\nWhen a user interacts with the application via the affected AJAX endpoint, the underlying codebase fails to validate whether the requesting user possesses the necessary capabilities, such as manage_options or edit_posts, before processing data retrieval requests.\nConsequently, an attacker authenticated with minimal privileges, such as a subscriber account, can leverage this insecure AJAX endpoint to issue crafted requests designed to query the database for arbitrary metadata entries.\nThe attack flow proceeds as follows: First, the adversary establishes a valid subscriber session on the target WordPress installation. Second, the attacker crafts an HTTP request targeting the exposed AJAX action, supplying specific parameters intended to query user metadata, post metadata, or term metadata. Third, lacking proper nonce validation and capability checks (such as current_user_can()), the vulnerable function processes the input parameters and executes database queries to retrieve the requested metadata.\nFinally, the application serializes and returns the sensitive metadata payload to the attacker in the HTTP response. The impact of this post-exploitation data exposure includes the unauthorized reading of internal application data, user meta containing sensitive tokens or configuration data, and potentially critical administrative information stored within the WordPress metadata tables.\nThe vulnerable component resides in versions of the WPC Admin Columns WordPress plugin before version 2.3.4."
}