CVE-2026-19598

Name of the Vulnerable Software and Affected Versions Pods – Custom Content Types and Fields versions prior to 3.3.9.1

Description The Pods – Custom Content Types and Fields plugin for WordPress contains a privilege escalation flaw allowing unauthenticated attackers to gain Administrator privileges or overwrite any user account password, including the site owner's, leading to complete site takeover. The issue resides in the pods admin AJAX router, which handles security checks such as method allowlists, nonce verification, login enforcement, and capability gates through the pods error() function. Under the JSON meta-box-loader compatibility path, pods error() only logs failures to the PHP error log and returns false without terminating the request, allowing execution to continue to privileged API methods such as save user(). Over 100,000 active installations are potentially affected, and real-world incidents have been reported where attackers added unauthorized administrator users to websites.

Recommendations Update the plugin to version 3.3.9.1 or the corresponding patched versions for older branches: 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, or 3.2.8.3.