CVE-2026-18943

The CVE covers the WPC Admin Columns WordPress plugin, pre-2.3.4. The issue is an authorization gap in one AJAX action, enabling users with a role as low as Subscriber to read arbitrary user, post, and term metadata, including data belonging to administrators. Impact is sensitive data disclosure ...