Description
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPC Admin Columns | < 2.3.4 | 2.3.4 |
References
- https://wpscan.com/vulnerability/9f2f3db0-1031-4e16-96f2-12a02b97ad06/ exploit vdb-entry technical-description