Pods
CVE-2026-19598 is a critical Pods authorization bypass that can let unauthenticated attackers reach administrator methods, overwrite user passwords, or obtain administrator privileges. Update to 3.3.9.1 or a backported fixed branch immediately.
Wordfence published a new advisory on August 21, 2026 for CVE-2026-19598, a critical unauthenticated privilege escalation vulnerability in Pods – Custom Content Types and Fields. Pods has more than 100,000 active installations and is widely used on sites with custom post types, fields, settings pages, and application-specific content structures.
The vulnerability affects Pods versions up to and including 3.3.9, plus several older maintained branches. The issue is an authorization bypass in the pods_admin AJAX router. According to the CVE record, failed checks for method allowlisting, nonce verification, login enforcement, and capability validation can be routed through pods_error(). Under the JSON meta-box-loader compatibility path, that failure path can log the error and return instead of terminating the request, leaving administrative operations reachable.
Risk Summary
- CVE: CVE-2026-19598
- Severity: CVSS 9.8 critical
- Weakness: CWE-863 incorrect authorization
- Privileges required: none
- User interaction: none
- Impact: administrator takeover, password overwrite, or other privileged administrative action
- Install base: WordPress.org lists 100,000+ active installations
Affected Versions And Fixed Builds
| Pods branch | Affected through | Fixed build |
|---|---|---|
| 2.8 | 2.8.23.3 | 2.8.23.4 |
| 2.9 | 2.9.19.3 | 2.9.19.4 |
| 3.0 | 3.0.10.3 | 3.0.10.4 |
| 3.1 | 3.1.4.1 | 3.1.4.2 |
| 3.2 | 3.2.8.2 | 3.2.8.3 |
| 3.3 | 3.3.9 | 3.3.9.1 |
WordPress.org lists Pods 3.3.9.1 as a major security hardening release dated August 14, 2026, with fixes backported to major versions from Pods 2.7 and above. If your environment can move to the current public release, update to 3.3.9.1 or newer. If you are pinned to an older branch, apply the corresponding backported fixed build.
Immediate Remediation
- Update Pods immediately to 3.3.9.1 or a matching backported fixed release.
- If you cannot patch immediately, deactivate Pods until the fixed build is deployed, unless the site depends on Pods for critical frontend functionality and you have a compensating WAF rule in place.
- Review all administrator accounts for unexpected users, email changes, password resets, and role changes.
- Invalidate active sessions and rotate administrator credentials if there is any sign of exploitation.
- Check web and PHP logs for unusual unauthenticated requests to WordPress AJAX endpoints involving Pods.
WP-CLI Verification
wp plugin get pods --fields=name,version,status
wp plugin update pods
wp plugin get pods --field=versionIf you cannot update safely during the current maintenance window, disable the plugin as a temporary containment step and confirm the site still serves critical pages from cache or fallback templates.
wp plugin deactivate podsAccount Review Queries
Run read-only checks for unexpected administrators and recently created users. Replace {prefix} with your WordPress database prefix if your WP-CLI environment does not expand it automatically.
wp db query "SELECT u.ID,u.user_login,u.user_email,u.user_registered FROM {prefix}users u JOIN {prefix}usermeta m ON m.user_id=u.ID WHERE m.meta_key='{prefix}capabilities' AND m.meta_value LIKE '%administrator%';"
wp db query "SELECT ID,user_login,user_email,user_registered FROM {prefix}users WHERE user_registered >= DATE_SUB(NOW(), INTERVAL 14 DAY);"Temporary WAF Mitigation
The safest remediation is the Pods patch. If patching is delayed, block unauthenticated POST requests to /wp-admin/admin-ajax.php when the request attempts to use the Pods administrative AJAX action. Test this rule on staging first because legitimate logged-in Pods admin screens may also use AJAX.
# Conceptual edge/WAF rule, not a replacement for the plugin update:
# if request.path == '/wp-admin/admin-ajax.php'
# and request.method == 'POST'
# and request.body contains 'action=pods_admin'
# and user is not authenticated:
# blockSources
