WPC Admin Columns Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the WPC Admin Columns plugin for WordPress, affecting versions 2.0.6 through 2.1.0. The issue arises because the plugin fails to properly restrict user meta values that can be modified via the ajax_edit_save() function. This vulnerability allows authenticated attackers with Subscriber-level access or higher to change their role to Administrator.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling users to gain administrative rights.

Remediation

Users are advised to update the WPC Admin Columns plugin to version 2.1.1 or a newer patched version.