CVE-2026-7654 Overview
CVE-2026-7654 is a PHP Object Injection vulnerability in the Admin Columns plugin for WordPress affecting all versions up to and including 7.0.18. The flaw resides in the IdsToCollection::get_ids_from_string() function, which calls unserialize() on attacker-controlled post meta values without specifying an allowed_classes restriction. Authenticated users with Contributor-level access or higher can inject a serialized PHP object into a post's custom meta field. The plugin bundles a Property-Oriented Programming (POP) gadget chain through the Laravel serializable-closure library, allowing the object injection to escalate into remote code execution as the web server user. The issue is tracked under CWE-502: Deserialization of Untrusted Data.
Critical Impact
Authenticated contributors can achieve remote code execution on the WordPress host by submitting a crafted serialized object that triggers a bundled closure-based POP gadget chain.
Affected Products
- Admin Columns plugin for WordPress, versions through 7.0.18
- Admin Columns Pro deployments that share the vulnerable IdsToCollection formatter
- WordPress sites bundling the Laravel serializable-closure library via this plugin
Discovery Timeline
- 2026-06-05 - CVE-2026-7654 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-7654
Vulnerability Analysis
The Admin Columns plugin renders custom columns in the WordPress admin by formatting post meta values through a chain of formatter classes. The Meta formatter passes raw meta values to the IdsToCollection formatter, which calls unserialize() directly on the input. PHP's default unserialize() behavior instantiates any class referenced in the serialized payload and invokes magic methods such as __wakeup(), __destruct(), and __toString() during object reconstruction. Because the plugin ships the Laravel serializable-closure package, a usable POP gadget chain is reachable inside the same execution context. An attacker chaining Laravel\SerializableClosure\Serializers\Native and Laravel\SerializableClosure\Support\ClosureStream can register a custom stream wrapper that compiles attacker-supplied PHP source and executes it when the closure is invoked.
Root Cause
The root cause is the use of unserialize($value) without the ['allowed_classes' => false] option in classes/Formatter/IdsToCollection.php. Combined with the bundled closure serializer in vendor/laravel/serializable-closure, the plugin exposes the application to a complete deserialization-to-RCE chain.
Attack Vector
A Contributor-level user creates or edits a post and assigns a serialized PHP object string to a custom meta field that the plugin will later format for display. When an administrator or any user browses an admin screen that triggers column rendering, IdsToCollection::get_ids_from_string() deserializes the payload. The bundled closure stream wrapper compiles attacker-controlled PHP and executes it under the web server account, yielding remote code execution. See the Wordfence Vulnerability Analysis and the vulnerable IdsToCollection source for the unsanitized call site, and the Laravel Closure Stream source for the gadget endpoint.
No public exploit code is provided in the enriched data, so no exploitation snippet is reproduced here. Refer to the linked references for technical reproduction details.
Detection Methods for CVE-2026-7654
Indicators of Compromise
- Post meta values starting with PHP serialization markers such as O:, a:, or C: in wp_postmeta rows associated with the Admin Columns plugin
- References to Laravel\SerializableClosure\Support\ClosureStream or the laravel-serializable-closure stream wrapper inside meta values or web server logs
- New or modified PHP files in the WordPress webroot created by the web server user shortly after Contributor account activity
- Outbound network connections initiated by php-fpm or the web server process to unfamiliar hosts
Detection Strategies
- Inspect wp_postmeta for serialized object payloads on rows touched by Contributor accounts, focusing on meta keys consumed by the Admin Columns formatters
- Add web application firewall rules that block POST bodies containing serialized class signatures targeting Laravel closure serializers
- Audit WordPress access logs for admin-screen requests immediately following Contributor post edits, since column rendering triggers the deserialization path
Monitoring Recommendations
- Alert on the web server user spawning shell interpreters such as sh, bash, or python from PHP processes
- Track file integrity changes under wp-content/, wp-includes/, and the active theme directory to catch webshell deployment
- Forward WordPress audit logs and PHP error logs to a centralized analytics pipeline for retroactive hunting across Contributor activity
How to Mitigate CVE-2026-7654
Immediate Actions Required
- Upgrade the Admin Columns plugin to a version later than 7.0.18 once the vendor releases a patched build referenced in the WordPress Code Change Log
- Audit all Contributor, Author, and Editor accounts and disable any that are unused or unrecognized
- Rotate WordPress secret keys in wp-config.php and reset administrator credentials if compromise is suspected
- Review wp_postmeta for serialized payloads and remove malicious rows before they are rendered by an admin
Patch Information
The vendor addressed the issue by hardening IdsToCollection::get_ids_from_string(). Site operators should install the fixed Admin Columns release that supersedes version 7.0.18. Track the upstream changeset and the Wordfence advisory for the exact fixed version and additional remediation notes.
Workarounds
- Temporarily disable the Admin Columns plugin until the patched release is installed
- Restrict post creation and editing privileges to trusted administrators using a role management plugin
- Deploy a WAF signature that blocks PHP serialization markers in post meta submissions and admin-ajax requests targeting Admin Columns endpoints
# Configuration example: disable Admin Columns via WP-CLI until patched
wp plugin deactivate codepress-admin-columns
wp plugin status codepress-admin-columns
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
