CVE-2026-19598: Pods Plugin Flaw Enables Complete Site Takeover, Attacks Seen in the Wild
Do Son 
TL;DR
CVE-2026-19598 is a CVSS 9.8 privilege escalation flaw in the Pods WordPress plugin. It lets unauthenticated attackers reach administrator power and seize complete site takeover. Wordfence reports blocking thousands of attacks against it within a single day. The plugin has an estimated 100,000 active installations.
- CVE: CVE-2026-19598
- CVSS: 9.8 (Critical · CVSSv3)
- Product: sc0ttkclark Pods – Custom Content Types and Fields
- Affected: 2.8, 2.9, 3.0, 3.1, 3.2, 3.3
- Impact: Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
- Status: Exploited in the wild
- EPSS: 0.5% (30-day)
- Action: See vendor advisory
Why This Pods Flaw Matters
Pods runs on an estimated 100,000 WordPress sites. As a result, the attack surface is large. This flaw needs no login at all. An unauthenticated attacker can rewrite any user’s password. That includes the site owner, which means complete site takeover. Wordfence details the issue in its public advisory.
How the Attack Works
The bug lives in the pods_admin AJAX router. That router runs several access checks. It verifies the method allowlist, login state, nonce, and capabilities. Each guard is meant to stop a bad request by calling pods_error().
However, pods_error() does not always stop execution. Under a JSON compatibility path, it only writes to the error log and returns false. So an attacker sends a JSON request with a specific parameter. Every failed guard then logs its error and lets the request continue.
With the guards bypassed, the router dispatches the attacker’s chosen method. One such method writes user data. Therefore an attacker can overwrite an administrator password and take over. Other admin methods are reachable too, which widens the impact.
Exploitation Status
This threat is active, not theoretical. Wordfence states it blocked 17,302 attacks against this flaw in one 24-hour window. That confirms exploitation attempts in the wild. No public proof-of-concept has been released at the time of writing.
Affected Versions
The flaw affects all Pods versions up to and including 3.3.9. The main fix ships in version 3.3.9.1. The vendor also backported fixes to 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, and 2.8.23.4.
Patch and Mitigation Steps
Update Pods to 3.3.9.1 or the matching patched release right away. The vendor pushed a forced update with WordPress.org, so many sites are already fixed. Still, verify your installed version by hand. If you cannot patch at once, disable the plugin. After updating, review user accounts and admin passwords for unexpected changes.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
