Privilege escalation in Wpclever Wpc Admin Columns
CVE-2025-3418
The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.
Vulnerability class: Privilege Escalation
EPSS: 0.004 (31.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Wpclever Wpc Admin Columns — versions 2.0.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-3418?
- CVE-2025-3418 is a high-severity vulnerability in Wpclever Wpc Admin Columns, classified under Improper Privilege Management. CVSS score: 8.8/10. Published 2025-04-12.
- How severe is CVE-2025-3418?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2025-3418 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.