CVE-2026-19598: WordPress Pods Plugin Privilege Escalation via Authorization Bypass

Overview

A critical privilege escalation vulnerability has been identified in the Pods – Custom Content Types and Fields plugin for WordPress, tracked as CVE-2026-19598 with a near-maximum CVSS score of 9.8. The flaw allows unauthenticated attackers to bypass authorization checks through the plugin's central AJAX routing mechanism and escalate to administrator-level access.

The Pods plugin is widely deployed across WordPress ecosystems to create and manage custom content types, making this vulnerability particularly high-impact. Sites running unpatched versions are at immediate risk of full compromise.

Technical Details

The vulnerability resides in the pods_admin AJAX router, which acts as a central dispatcher for all Pods plugin AJAX actions. The router's authorization logic — including its method allowlist and nonce validation — contains flaws that can be bypassed without authentication.

How it works:

1. An unauthenticated HTTP request is sent to wp-admin/admin-ajax.php targeting the pods_admin action.
2. The AJAX router fails to properly enforce capability checks before dispatching to privileged internal methods.
3. An attacker can invoke privileged Pods methods — including those that modify user roles or create administrator accounts — without holding any WordPress session credentials.

This type of vulnerability is particularly severe in WordPress environments because the CMS's AJAX infrastructure (admin-ajax.php) is designed to be publicly reachable, and many plugins rely on it for both authenticated and unauthenticated flows.

Affected Versions

All versions of Pods – Custom Content Types and Fields up to and including 3.3.9 are vulnerable. The CVE was published August 15, 2026.

Mitigation

• Update the Pods plugin immediately to the patched version available in the WordPress Plugin Repository.
• If an immediate update is not possible, consider deactivating the plugin until the patch can be applied.
• Audit WordPress user accounts for unauthorized administrator additions, especially if your site has been exposed with a vulnerable version.
• Use a Web Application Firewall (WAF) to temporarily block suspicious admin-ajax.php requests targeting pods_admin actions.
• Review WordPress security logs for anomalous role changes or new admin account creation events.

References

• NVD: CVE-2026-19598
• WordPress Plugin: Pods – Custom Content Types and Fields