CVE-2026-19598
CriticalCVSS 9.8Summary
The Pods – Custom Content Types and Fields plugin for WordPress up to version 3.3.9 contains a privilege escalation vulnerability via authorization bypass. The pods_admin AJAX router funnels all access checks through pods_error(), which in the JSON meta-box-loader compatibility path only logs failures and returns false instead of terminating the request, rendering all guards ineffective. Unauthenticated attackers can escalate privileges to Administrator or overwrite any user's password, including the site owner's, enabling complete site takeover.
Risk Assessment
Risk of complete WordPress site takeover by an unauthenticated attacker, potentially leading to data loss, visitor infection, or server abuse for further attacks.
Recommendation
Update the Pods plugin to the latest patched version. If unavailable, temporarily disable the plugin or restrict access to the admin panel.
Original NVD description (English source)
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.