The Admin Columns WordPress plugin suffers from a PHP Object Injection vulnerability (CWE-502) due to the use of unserialize() without restricting allowed classes in the IdsToCollection::get_ids_from_string() function. This function processes attacker-controlled post meta values without proper validation, enabling authenticated attackers with Contributor-level privileges or above to inject serialized PHP objects. Exploiting a bundled POP gadget chain, attackers can achieve remote code execution with the privileges of the web server user. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No official patch or remediation level has been published, and no known exploits in the wild have been reported.

Successful exploitation allows authenticated users with Contributor-level access or higher to execute arbitrary code remotely on the web server hosting the vulnerable WordPress plugin. This compromises confidentiality, integrity, and availability of the affected system, potentially leading to full server compromise under the web server's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level user capabilities if possible and monitor for suspicious activity related to post meta manipulation. Avoid using or disable the vulnerable plugin version if feasible.