Critical WordPress Pods Flaw Lets Unauthenticated Attackers Gain Admin Access

A critical vulnerability has been identified in the widely used Pods WordPress plugin, which could allow unauthenticated attackers to take complete control of affected websites by escalating privileges to the administrator level.

This vulnerability, tracked as CVE-2026-19598, carries a CVSS score of 9.8 and affects Pods – Custom Content Types and Fields versions up to and including 3.3.9.

With over 100,000 active installations, this vulnerability poses a significant risk for WordPress site operators who have not yet applied the available security updates.

Critical WordPress Pods Flaw

Security researcher Nhien Pham, known as nhienit, discovered and responsibly disclosed the issue through the Wordfence Bug Bounty Program, receiving a $3,900 reward for his findings.

The vulnerability lies in the Pods’ publicly accessible `pods_admin` AJAX router, which dispatches requests to internal administrative API methods.

Normally, the router is expected to validate that a requested method is allowlisted, confirm that the requester is authenticated, verify a WordPress nonce, and ensure the user has sufficient privileges.

However, each of these security checks relies on the plugin’s `pods_error()` function to terminate execution when validation fails. In a specific JSON compatibility path involving the `meta-box-loader` parameter, `pods_error()` logs an error but returns false instead of stopping the request.

As a result, the calling AJAX handler does not return after invoking the error function, allowing execution to continue despite failed authorization, authentication, nonce, and capability checks.

This means an unauthenticated attacker can access privileged functionality exposed by the router.

Researchers have determined that attackers could invoke the `save_user` API method and supply parameters targeting an existing user account.

Since this method does not independently enforce authentication, capability, or ownership validation before reaching WordPress user-management functions, an attacker could overwrite the password of an administrator or site owner.

Successful exploitation would allow an attacker to authenticate as the compromised administrator and take control of the WordPress instance.

The impact could extend beyond password resets, as Wordfence warned that the bypass affects the `pods_admin` router in its entirety, potentially exposing other privileged operations.

Depending on the reachable API functionality and site configuration, attackers may execute administrator-level actions, write PHP files, or delete files.

This issue highlights a common design failure in authorization: security-sensitive code must stop execution immediately after an access-control failure. Simply returning an error value is insufficient if the caller ignores it and continues processing attacker-controlled requests.

Pods released version 3.3.9.1 on August 14, 2026, after Wordfence disclosed the flaw to the development team on August 12. Fixes have also been backported to supported major branches:

• 2.8.23.4
• 2.9.19.4
• 3.0.10.4
• 3.1.4.2
• 3.2.8.3
• 3.3.9.1

The Pods team is coordinating with WordPress.org to force-update vulnerable installations. However, administrators should immediately verify the installed Pods version rather than relying solely on automatic updates.

Wordfence Premium, Care, and Response customers received firewall protection on August 12. Users of the free Wordfence edition are scheduled to receive the same rule on September 11.

Site owners should update Pods without delay, review administrator accounts for any unauthorized changes, reset privileged passwords where compromise is suspected, and inspect server and WordPress logs for unusual requests targeting the plugin’s AJAX functionality.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC