CVE-2025-3418: WPC Admin Columns Privilege Escalation

CVE-2025-3418 Overview

CVE-2025-3418 is a privilege escalation vulnerability in the WPC Admin Columns plugin for WordPress, affecting versions 2.0.6 through 2.1.0. The flaw resides in the ajax_edit_save() function, which fails to restrict which user meta values authenticated users can modify. Attackers holding Subscriber-level access or higher can leverage this weakness to assign themselves the administrator role. Successful exploitation grants full control over the WordPress site, including content, plugins, themes, and user accounts. The vulnerability is classified under [CWE-269] Improper Privilege Management.

Critical Impact

Authenticated users with minimal privileges can escalate to administrator and take complete control of the WordPress site.

Affected Products

• WPC Admin Columns plugin for WordPress, version 2.0.6
• WPC Admin Columns plugin for WordPress, versions 2.0.7 through 2.0.9
• WPC Admin Columns plugin for WordPress, version 2.1.0

Discovery Timeline

• 2025-04-12 - CVE-2025-3418 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3418

Vulnerability Analysis

The WPC Admin Columns plugin exposes an AJAX handler named ajax_edit_save() that processes inline edits for fields displayed in the WordPress admin columns interface. The handler accepts user-supplied input identifying both the meta key and meta value to update without restricting which keys are eligible for modification. Because WordPress stores role assignments in the wp_capabilities user meta key, an attacker can submit a crafted AJAX request targeting their own user record and overwrite this value. The result is a vertical privilege escalation from Subscriber to Administrator within a single authenticated request.

Root Cause

The root cause is improper privilege management in ajax_edit_save(). The function lacks an allowlist of permitted meta keys and does not verify whether the current user is authorized to modify sensitive fields such as role and capability data. It also fails to enforce capability checks like current_user_can('edit_users') before persisting changes through update_user_meta().

Attack Vector

Exploitation requires only a valid low-privilege account on the target site. An attacker authenticates as a Subscriber, obtains a valid nonce from the plugin interface, and issues an AJAX POST request to the admin-ajax endpoint invoking the edit_save action. The request specifies the attacker's user ID, the wp_capabilities meta key, and a serialized value granting the administrator role. The vulnerable handler writes the value directly to user meta, completing the escalation.

The vulnerability mechanism is documented in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-3418

Indicators of Compromise

• Unexpected administrator accounts that previously held Subscriber, Contributor, or Author roles.
• POST requests to /wp-admin/admin-ajax.php with the action=edit_save parameter originating from low-privilege sessions.
• Modifications to the wp_capabilities row in the wp_usermeta table that do not correspond to legitimate admin actions.
• Installation of unauthorized plugins, themes, or new admin users shortly after a Subscriber login.

Detection Strategies

• Audit the wp_users and wp_usermeta tables for role changes and compare against expected administrator accounts.
• Review web server access logs for POST requests to admin-ajax.php referencing the WPC Admin Columns edit_save action from accounts that should not have edit privileges.
• Enable WordPress audit logging plugins to capture role assignment events and AJAX activity per user.

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized logging platform and alert on user role escalation events.
• Monitor for newly created administrator sessions correlated with recent low-privilege logins from the same IP address.
• Track plugin file integrity for wpc-admin-columns and alert when the installed version remains at or below 2.1.0.

How to Mitigate CVE-2025-3418

Immediate Actions Required

• Update the WPC Admin Columns plugin to a version later than 2.1.0 that contains the upstream fix.
• Audit all WordPress accounts and revoke administrator privileges from any user that should not hold them.
• Force password resets and invalidate active sessions for all users following the audit.
• Review installed plugins, themes, and scheduled tasks for unauthorized modifications introduced during the exposure window.

Patch Information

The vendor addressed the issue in the plugin code base. The fix is visible in the WordPress Plugin Changeset, which restricts the meta keys accepted by ajax_edit_save() and adds capability checks before updating user meta.

Workarounds

• Deactivate and remove the WPC Admin Columns plugin until the patched version can be deployed.
• Restrict registration to trusted users and disable open user registration to limit who can obtain Subscriber-level access.
• Apply a web application firewall rule to block POST requests to admin-ajax.php carrying the edit_save action when the meta_key parameter equals wp_capabilities.

# Configuration example: disable open registration in wp-config.php
define('DISALLOW_FILE_EDIT', true);
# In WordPress Settings > General, uncheck "Anyone can register"
# Or enforce via the option:
wp option update users_can_register 0