CVE-2026-18943
Description
AI Translation Available
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.
https://wpscan.com/vulnerability/9f2f3db0-1031-4e16-96f2-12a02b97ad06/