WordPress Pods Plugin <= 3.3.9 Vulnerable to Privilege Escalation
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- pods-custom-content-types-and-fields (wordpress)
- Patched version
- Not yet available
The Pods, Custom Content Types and Fields plugin for WordPress is reportedly vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9.
What happened
An early warning has been issued for a critical vulnerability in the Pods, Custom Content Types and Fields plugin for WordPress. The vulnerability, tracked as CVE-2026-19598, allows unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, enabling complete site takeover. This is due to an authorization bypass in the pods_admin AJAX router, which funnels every access check through pods_error(), rendering all guards ineffective under the JSON meta-box-loader compatibility path.
The vulnerability affects all versions of the plugin up to, and including, 3.3.9. There is currently no official fix available, and the issue is under investigation. Users are advised to monitor the sources below for updates and take immediate action to secure their sites.
What to do about it
- Review the versions of the Pods, Custom Content Types and Fields plugin installed on your WordPress sites.
- If you are using version 3.3.9 or earlier, upgrade to a version beyond 3.3.9 as soon as it is available.
- Review user accounts for any suspicious activity, especially if you suspect a compromise.
- Monitor the primary sources for updates on a patched version.
- Consider implementing additional security measures, such as two-factor authentication, to protect user accounts.
How 0Day would have caught this
pods-custom-content-types-and-fields is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Pods, Custom Content Types and Fields plugin for WordPress version 3.3.9 or earlier, you are potentially affected.
What should I do right now?
Review your plugin versions and upgrade to a version beyond 3.3.9 as soon as it is available. Monitor user accounts for suspicious activity.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.