Originally published at HOL
BREAKING: CVE-2026-19598 - Pods WordPress Plugin Unauthenticated Admin Takeover
TL;DR: The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to an unauthenticated authorization bypass through its pods_admin AJAX router. Wordfence's CNA record says every access gate, including the method allowlist, nonce check, login check, and capability check, can flow through pods_error() without terminating the request on a JSON compatibility path. An unauthenticated attacker can reach administrator methods, promote an account to Administrator, or overwrite a user's password. CVE-2026-19598 is CVSS 9.8 CRITICAL. Pods versions through 3.3.9 are affected. Upgrade to the current 3.3.9.1 security-hardening release.
What happened
The vulnerable surface is the plugin's pods_admin AJAX router. Requests reaching that router are supposed to be stopped by multiple checks before an administrative method executes: the requested method must be allowed, a valid nonce must be present, the caller must be logged in, and the caller must have the required capability.
The CVE record explains that these failures are routed through pods_error(). Under the JSON meta-box-loader compatibility path, that error handling can write the failure to the PHP error log and return false instead of terminating execution. The authorization checks therefore record a failure without reliably stopping the request.
That changes the bug from a single missing check into a router-level bypass. Wordfence says an unauthenticated attacker can invoke administrator methods to escalate privileges to Administrator or overwrite the password of an existing user, including the site owner.
The CNA assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, or 9.8 CRITICAL, and maps the issue to CWE-863, Incorrect Authorization.
Affected versions
The CVE record marks the following maintained branches as affected through these versions:
- Pods 2.8 through
2.8.23.3 - Pods 2.9 through
2.9.19.3 - Pods 3.0 through
3.0.10.3 - Pods 3.1 through
3.1.4.1 - Pods 3.2 through
3.2.8.2 - Pods 3.3 through
3.3.9
WordPress.org currently lists Pods 3.3.9.1, released August 14, 2026, as a major security-hardening release. The CVE's affected range ends at 3.3.9, making 3.3.9.1 the current upgrade target. WordPress.org reports more than 100,000 active installations for Pods.
What to do
Update Pods immediately from WordPress Admin, or with WP-CLI:
wp plugin update pods
Then verify the installed version:
wp plugin get pods --field=version
The expected current version is 3.3.9.1 or newer. If you cannot update immediately, disable the Pods plugin until the patched build can be deployed:
wp plugin deactivate pods
Because this issue can modify user privileges and passwords, review WordPress administrator accounts and recent user changes after patching. Rotate credentials for any administrator account with unexplained changes, and check web/WAF logs for unusual unauthenticated requests to WordPress AJAX endpoints involving Pods.
Why this matters
This is a network-reachable, no-credentials, no-user-interaction path to full WordPress administrative control. An attacker who gains Administrator access can install plugins, modify themes, create persistent accounts, alter site content, and use the WordPress host as a foothold for further compromise.
The blast radius is amplified by Pods' deployment footprint. The plugin is used to create custom post types, taxonomies, fields, settings pages, roles, and other application-specific data structures, so affected installations frequently sit on business-critical WordPress sites rather than disposable test environments.
