CVE-2026-7654: Admin Columns WordPress Plugin RCE via PHP Object Injection

Technical summary

CVE-2026-7654 exploits unsafe deserialization in the Admin Columns plugin's `IdsToCollection::get_ids_from_string()` function. The function processes post meta values using `unserialize()` without restricting the `allowed_classes` parameter, making it vulnerable to PHP Object Injection (CWE-502). Attackers leverage a POP (Property-Oriented Programming) gadget chain bundled within the plugin to convert the injected serialized object into remote code execution. The vulnerability requires authentication at contributor level or above, but does not require user interaction.

Business impact

Compromise of a WordPress site running the vulnerable Admin Columns plugin could lead to full server takeover. An attacker gaining RCE as the web server user can steal sensitive data, modify content, install backdoors, pivot to internal systems, or use the compromised host for lateral movement. The requirement for contributor-level access means the attack surface includes all users with basic content creation privileges—a common permission tier in multi-author WordPress environments. Data breach, service disruption, and remediation costs are significant organizational risks.

Affected systems

WordPress sites with the Admin Columns plugin installed and active in versions 7.0.18 and earlier are affected. The vulnerability is accessible to any authenticated user with contributor-level permissions or higher (contributor, author, editor, administrator). Sites without the plugin are not affected; those running the plugin on versions prior to 7.0.18 require immediate attention.

Exploitability

Exploitation requires valid WordPress authentication credentials with at least contributor-level access. An attacker does not need administrator privileges, greatly expanding the threat actor pool to include compromised or malicious content creators. No user interaction is needed; the attack is fully automated once the malicious serialized object is injected into a post meta field. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network accessibility, low attack complexity, low privilege requirements, and high impact across confidentiality, integrity, and availability.

Remediation

Update the Admin Columns plugin to a patched version that addresses the unsafe deserialization. Verify against the official Admin Columns plugin advisories and changelog for the recommended minimum version. Organizations should restrict contributor-level access to trusted personnel only and audit existing contributors for suspicious activity. For immediate mitigation pending patches, consider deactivating the plugin if not critical to operations, or implement Web Application Firewall (WAF) rules to detect and block serialized PHP payloads in POST requests targeting post meta endpoints.

Patch guidance

Check the official Admin Columns plugin repository and vendor advisories for patched versions released after June 17, 2026. Update immediately via the WordPress admin dashboard or by downloading the latest version directly from the vendor. After patching, verify the update in the Plugins menu and confirm the version number reflects the security fix. Test functionality on a staging environment before deploying to production.

Detection guidance

Monitor for POST requests to wp-admin/admin-ajax.php or post update endpoints containing serialized PHP objects (identifiable by 'O:' prefix followed by class name and property counts). Log and alert on any post meta modifications originating from contributor-level accounts, especially those containing base64-encoded or suspicious serialized data. Review post meta tables in the WordPress database for anomalous entries. Implement file integrity monitoring on the wp-content directory to detect unauthorized plugin or theme modifications resulting from exploitation. Check web server logs for unexpected process spawning or privilege escalation attempts coinciding with post meta updates.

Why prioritize this

This vulnerability merits urgent patching due to its high severity (CVSS 8.8), unauthenticated RCE potential, and low barrier to exploitation. The inclusion of a functional POP gadget chain and the prevalence of the Admin Columns plugin across WordPress installations make this a high-impact threat. The requirement for only contributor-level access—a common permission in enterprise WordPress deployments—increases likelihood of exploitation by insider threats or compromised low-privilege accounts.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network vector—the attack is remotely exploitable via HTTP; (2) Low attack complexity—no special conditions or race conditions required; (3) Low privileges required—contributor-level access is easily obtainable and common; (4) No user interaction needed—the attack is fully automated; (5) Complete impact—successful exploitation grants confidentiality, integrity, and availability compromise as the web server user. The absence of CISA KEV listing does not diminish the severity; patching should not be delayed pending KEV inclusion.

Frequently asked questions