Pods Plugin for WordPress <= 3.3.9 - Unauthenticated Privilege Escalation (CVE-2026-19598)
Description
The Pods - Custom Content Types and Fields plugin for WordPress (all versions up to and including 3.3.9) contains an unauthenticated authorization bypass (CVE-2026-19598). The pods_admin AJAX router passes every failed access check through pods_error(). When the request includes the ?meta-box-loader=1 query parameter, pods_error() only writes to the PHP error log and returns false instead of terminating execution, silently bypassing the method allowlist, nonce verification, login enforcement, and capability gate. An unauthenticated attacker can therefore invoke privileged pods_admin methods such as save_user to create or overwrite WordPress user accounts, including site administrators.
Remediation
Update immediately: upgrade the Pods - Custom Content Types and Fields plugin to a version newer than 3.3.9 that addresses CVE-2026-19598.
If an immediate upgrade is not possible, apply the following temporary mitigations:
1. Disable the Pods plugin until a patched release is available.
2. Block unauthenticated POST requests to /wp-admin/admin-ajax.php?meta-box-loader=1 at the WAF or web-server level.
3. Audit WordPress user accounts for any unexpected accounts created recently and remove them.
4. Review authentication logs for logins from accounts you did not create.
After patching, rotate all WordPress administrator credentials and regenerate secret keys and salts in wp-config.php.