CVE-2026-19598

The Pods – Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) routes every access check on its pods_admin AJAX router — the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which in the JSON meta-box-loader compatibility path only writes a PHP error-log entry and returns false instead of terminating the request. As a result, an unauthenticated request sent through this AJAX path passes all of the plugin's guards without being stopped and can invoke privileged administrator actions. An attacker can escalate to Administrator or overwrite the password of any user account, including the site owner's, achieving complete site takeover or performing other administrator-level actions. Any WordPress site running an affected version of the plugin is exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, though the 9.8 CVSS score and elevated EPSS (2.8%, 86th percentile) make it a high-priority patching target.

What to do: Update the Pods plugin to a release newer than 3.3.9 as soon as a patched version is published (no fixed version is named in the disclosure), or deactivate the plugin until then. Audit the WordPress users list for unexpected Administrator accounts and verify that admin passwords have not been changed, since successful exploitation enables full site takeover. As an interim measure, a WAF rule restricting unauthenticated access to the pods_admin route on admin-ajax.php can reduce exposure.