Junglewise Threat Intelligence

CVE-2026-7654: CodePress Admin Columns PHP Object Injection in IdsToCollection

CVE-2026-7654 · Severity: high · CVSS 8.8 · Published 2026-06-05

Executive brief

Admin Columns is a WordPress plugin used to manage and customize the display of website content in the administrative dashboard. A security flaw allows users with basic contributor-level access to run unauthorized commands on the web server. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services.

Technical details

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 7.0.18. The root cause is the use of the `unserialize()` function without an `allowed_classes` restriction within the `IdsToCollection::get_ids_from_string()` function. This function processes attacker-controlled post meta values without sufficient validation. An authenticated attacker with Contributor-level permissions or higher can inject a serialized PHP object into a post's custom meta field. By leveraging a bundled POP (Property Oriented Programming) gadget chain, the attacker can achieve remote code execution (RCE) with the privileges of the web server user.

Affected products

  • CodePress Admin Columns up to and including 7.0.18

Timeline

  • 2026-06-05: disclosed
  • 2026-06-05: advisory

References