CVE-2026-74853
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Pods WordPress plugin before version 3.3.9.2 does not restrict which functions a display callback may resolve to. This allows users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Risk Assessment
Users with the author role can access sensitive server files, such as configuration files with passwords, potentially leading to full system compromise.
Recommendation
Update the Pods plugin to version 3.3.9.2 or later and ensure the restricted mode is enabled.
Other vulnerabilities in Pods
Original NVD description (English source)
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.