Privilege Escalation Vulnerability in WPC Admin Columns Plugin for WordPress

CVE-2025-3418

What is CVE-2025-3418?

The WPC Admin Columns plugin for WordPress prior to version 2.1.0 is vulnerable to privilege escalation due to improper handling of user meta values in the ajax_edit_save() function. This allows authenticated users with Subscriber-level access and higher to manipulate their roles, potentially granting themselves administrative privileges without authorization.

References