The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection caused by an unserialize call that lacks an allowed_classes filter. This flaw enables an attacker who can insert a serialized PHP object into a post's custom meta field to trigger a bundled POSt POP gadget chain, resulting in arbitrary code execution with the web server's privileges. The impact is the ability to run malicious code on the server from within a WordPress site.

Any WordPress site running the Admin Columns plugin version 7.0.18 or earlier is affected. The plugin is distributed under the codepress:Admin Columns package and modifies how custom field metadata is processed, so any installation of the plugin before the patch is vulnerable.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not provided, and the flaw is not listed in the CISA KEV catalog. Because the attack requires an authenticated user with Contributor-level access or higher, the attack vector is limited to authorized users who can edit post meta. However, once an authenticated attacker injects the malicious payload, remote code execution is achieved automatically, posing significant risk to the site and its data.