Admin Columns < 7.0.19 - Contributor+ PHP Object Injection to Remote Code Execution via Custom Field Meta Value

Description

The plugin is vulnerable to PHP Object Injection due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for authenticated attackers with Contributor-level access and above to inject a serialized PHP object into a post's custom meta field; combined with a POP gadget chain bundled with the plugin, this leads to remote code execution as the web server user.