CVE-2026-19598

Received Received - Intake

Privilege Escalation in Pods WordPress Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: Wordfence

Description

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-19598

EUVD

EUVD-2026-59778

Affected Vendors & Products

Vendor	Product	Version / Range
pods	custom_content_types_and_fields	to 3.3.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The Pods – Custom Content Types and Fields WordPress plugin has a privilege escalation vulnerability due to an authorization bypass. The flaw exists because the plugin's AJAX router fails to properly enforce access controls under certain conditions. Specifically, the pods_admin AJAX router routes all access checks through pods_error(), which under the JSON meta-box-loader compatibility path only logs failures to the PHP error log and returns false instead of blocking the request. This allows unauthenticated attackers to bypass security measures and escalate privileges to Administrator level or overwrite user passwords, including the site owner's.

Impact Analysis

This vulnerability allows unauthenticated attackers to take over your WordPress site completely. They can escalate their privileges to Administrator, overwrite any user's password including the site owner's, or perform any other administrator-level actions. This results in full control of your website, potential data theft, defacement, or use of your site for malicious purposes.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful exploit could lead to data breaches, unauthorized modifications, or disclosure of regulated data, resulting in legal penalties, fines, and reputational damage for organizations subject to these regulations.

Mitigation Strategies

Update the Pods – Custom Content Types and Fields plugin to the latest version beyond 3.3.9 immediately to patch the privilege escalation vulnerability.

Hi! I’m here to help you understand CVE-2026-19598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70