CVE-2026-18943: Unknown Wpc Admin Columns

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.

Affected products

• Unknown Wpc Admin Columns: before 2.3.4 (fixed in 2.3.4)

Published 2026-08-12. Last modified 2026-08-26.