CVE-2026-18943 Overview
CVE-2026-18943 is a broken access control vulnerability in the WPC Admin Columns WordPress plugin before version 2.3.4. The plugin exposes an AJAX action without authorization checks. Authenticated users with a role as low as subscriber can read arbitrary user, post, and term metadata. This includes metadata belonging to administrator accounts. The flaw is classified as an information exposure issue [CWE-200] and requires only low-privilege network access to exploit.
Critical Impact
Any authenticated subscriber can read arbitrary WordPress metadata, including sensitive fields belonging to administrators, leading to disclosure of confidential site and user information.
Affected Products
- WPC Admin Columns WordPress plugin versions prior to 2.3.4
- WordPress sites permitting user registration at subscriber role or higher
- WordPress installations exposing the plugin's AJAX endpoint to authenticated users
Discovery Timeline
- 2026-08-12 - CVE-2026-18943 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-18943
Vulnerability Analysis
The WPC Admin Columns plugin registers an AJAX action intended for administrative use in the WordPress dashboard. The handler processes requests from any authenticated user but does not verify whether the caller has the required capability to read the requested metadata. As a result, low-privileged accounts can invoke the endpoint and retrieve metadata for arbitrary users, posts, and taxonomy terms.
The exposed metadata can include private post fields, custom user profile data, and any term meta stored by other plugins. Administrator accounts often store session tokens, application passwords, security keys, and personal information within usermeta. Disclosure of these values assists follow-on attacks such as credential abuse or targeted phishing against site operators.
Root Cause
The root cause is a missing authorization check inside an AJAX action registered through the wp_ajax_ hook. The handler relies on nonce or authentication only and does not call current_user_can() to validate the caller's capability. WordPress treats any logged-in user as authorized for wp_ajax_ actions unless the handler enforces stricter checks.
Attack Vector
An attacker first obtains a subscriber-level account on the target site. On sites with open registration this requires no social engineering. The attacker then sends crafted POST requests to wp-admin/admin-ajax.php specifying the vulnerable action and the identifier of the target user, post, or term. The server returns the requested metadata in the AJAX response.
Refer to the WPScan Vulnerability Detail for further technical context on the vulnerable AJAX handler.
Detection Methods for CVE-2026-18943
Indicators of Compromise
- Repeated POST requests from low-privilege sessions to wp-admin/admin-ajax.php referencing the WPC Admin Columns AJAX action
- Unexpected enumeration patterns where sequential user, post, or term IDs are queried by non-administrative accounts
- Subscriber accounts generating dashboard-adjacent AJAX traffic outside normal front-end browsing behavior
Detection Strategies
- Inspect web server and PHP access logs for admin-ajax.php calls originating from users with the subscriber role
- Correlate WordPress audit logs with HTTP request bodies to identify metadata queries against administrator user IDs
- Deploy a Web Application Firewall (WAF) rule to flag AJAX actions registered by WPC Admin Columns when invoked by non-admin sessions
Monitoring Recommendations
- Enable a WordPress activity log plugin to capture AJAX action invocations and associated user roles
- Alert on newly registered subscriber accounts that immediately generate admin-ajax.php traffic
- Monitor outbound data volume from admin-ajax.php responses to identify bulk metadata scraping
How to Mitigate CVE-2026-18943
Immediate Actions Required
- Upgrade the WPC Admin Columns plugin to version 2.3.4 or later on all WordPress installations
- Audit subscriber and low-privilege accounts for suspicious activity and remove unrecognized users
- Rotate administrator credentials, application passwords, and API keys stored in usermeta if exploitation is suspected
Patch Information
The vendor addressed the vulnerability in WPC Admin Columns version 2.3.4 by adding proper authorization checks to the affected AJAX action. Refer to the WPScan Vulnerability Detail for the fixed release information.
Workarounds
- Disable the WPC Admin Columns plugin until the site can be upgraded to version 2.3.4
- Restrict new user registration or set the default role to a custom role with no dashboard access
- Block requests to admin-ajax.php originating from non-administrative users at the WAF or reverse proxy layer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
