UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-7654

Admin Columns: Deserialization of Untrusted Data

Severity
High 8.8
Published
5 Jun 2026
Added to UpHeron
30 Oct 2026
Fixed in
7.0.19
Also known as
EUVD-2026-34922, WPV-2445e6127c94
Sources
WPVulnerability

Affected software

SoftwareAffected versions
Codepress Admin Columns (WordPress plugin)WordPress plugins · wp-plugin:codepress-admin-columns
  • Every version before 7.0.19

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7654
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/codepress-admin-columns/admin-columns-7018-authenticated-contributor-php-object-injection-to-remote-code-execution-via-custom-field-meta-value