CVE-2026-7654: Admin Columns PHP Object Injection to RCE (CVSS 8.8)

CVE-2026-7654 is a CVSS 8.8 PHP Object Injection flaw in Admin Columns that lets a Contributor trigger RCE by injecting a serialized object into a custom post meta field.