Pods Plugin Unauthorized Privilege Escalation Vulnerability (CVE-2026-19598)

Vulnerability Overview Vulnerability Name: Privilege Escalation Vulnerability in Pods WordPress Plugin Vulnerability Type: Unauthenticated Privilege Escalation Vulnerability Description: The Pods plugin allows unauthenticated attackers to elevate their privileges by bypassing authorization checks, thereby executing various administrator operations, such as overwriting the passwords of any user account, leading to complete takeover of the website. Reporter: Nhiên Pham (nhiemit) Report Date: August 10, 2026 Patch Date: August 14, 2026 CVSS Score: 9.8 (Critical) CVE Number: CVE-2026-19598 Scope of Impact Affected Plugin: Pods - Custom Content Types and Fields Affected Versions: 3.3.9 and below Impacted Users: Over 100,000 WordPress sites Affected Function: AJAX route Remediation Fixed Version: 3.3.9.1 Other Fixed Versions: 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, 2.8.23.4 Recommended Actions: - Immediately update to the latest version of the Pods plugin. - Users of Wordfence Premium, Wordfence Care, or Wordfence Response already have firewall rules automatically updated to protect against known exploits. - Users of the free version of Wordfence will receive the same protection on September 11, 2026. Technical Details Vulnerability Cause: In version 3.3.9 and below, the AJAX route function failed to correctly terminate the request when handling errors via the function, leading to a failure in permission checks. Code Example: Additional Information Wordfence Protection: Users of Wordfence Premium, Wordfence Care, and Wordfence Response have already received automatic firewall rule protection. Free User Protection: Free version of Wordfence users will receive the same protection on September 11, 2026. Vulnerability Reward: The reporter, Nhiên Pham, received a reward of $3,900.00.

Goal Reached Thanks to every supporter — we hit 100%!

Pods Plugin Unauthorized Privilege Escalation Vulnerability (CVE-2026-19598)

More from this source