CVE-2026-74853
Received Received - Intake

Arbitrary File Read in Pods WordPress Plugin

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-74853
EUVD
EUVD-2026-70903

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pods pods to 3.3.9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Pods WordPress plugin versions before 3.3.9.2. It allows users with author role or higher to read arbitrary files from the server, including those outside the web root. This happens because the plugin does not properly restrict which functions a display callback can use.

Detection Guidance

Check the installed version of the Pods plugin in WordPress. If it is below 3.3.9.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If you use an affected version of the Pods plugin, an attacker with author role or higher could access sensitive files on your server. This includes configuration files, databases, or other critical system files outside the web root, potentially leading to data breaches or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Update the Pods plugin to version 3.3.9.2 or later immediately. Remove or restrict access for users with the author role or higher until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart