codepress Admin Columns vulnerabilities

Latest codepress Admin Columns CVEs

Newest publication first

1. CVE-2026-7654 Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

   Published 2026-06-05

   High·CVSS 8.8 EPSS 0.91%

   The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of unserialize() without an allowed_classes restriction in the IdsToCollection::get_ids_from_string() funct...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.