CVE-2025-3418: 
WordPress vulnerability analysis and mitigation

The WPC Admin Columns plugin for WordPress contains a privilege escalation vulnerability (CVE-2025-3418) affecting versions 2.0.6 to 2.1.0. The vulnerability was discovered and disclosed on April 12, 2025. The issue exists in the ajax_edit_save() function, which fails to properly restrict user meta value updates (NVD).

The vulnerability stems from improper privilege management (CWE-269) in the plugin's ajax_edit_save() function. The CVSS v3.1 base score is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable vulnerability requiring low attack complexity and privileges (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to update their role to that of an administrator, effectively gaining full administrative control over the WordPress site (NVD).

The vulnerability requires authentication with at least Subscriber-level access. Once authenticated, an attacker can exploit the vulnerability through the ajax_edit_save() function to elevate their privileges (NVD).

The vulnerability has been patched in version 2.1.1 of the WPC Admin Columns plugin. The fix includes adding proper capability checks before allowing user meta value updates (WordPress Plugin).