SECURITYCRITICALCVE-2026-19598

CVE-2026-19598: WordPress Pods Plugin Privilege Escalation via Authorization Bypass

CVSS 9.8 flaw in WordPress Pods plugin lets unauthenticated users escalate privileges via a flawed AJAX authorization router in versions up to 3.3.9.

Dylan H.

Security Team

August 16, 2026
2 min read
CVE-2026-19598: WordPress Pods Plugin Privilege Escalation via Authorization Bypass

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Pods – Custom Content Types and Fields <= 3.3.9

Overview

A critical privilege escalation vulnerability has been identified in the Pods – Custom Content Types and Fields plugin for WordPress, tracked as CVE-2026-19598 with a near-maximum CVSS score of 9.8. The flaw allows unauthenticated attackers to bypass authorization checks through the plugin's central AJAX routing mechanism and escalate to administrator-level access.

The Pods plugin is widely deployed across WordPress ecosystems to create and manage custom content types, making this vulnerability particularly high-impact. Sites running unpatched versions are at immediate risk of full compromise.

Technical Details

The vulnerability resides in the pods_admin AJAX router, which acts as a central dispatcher for all Pods plugin AJAX actions. The router's authorization logic — including its method allowlist and nonce validation — contains flaws that can be bypassed without authentication.

How it works:

  1. An unauthenticated HTTP request is sent to wp-admin/admin-ajax.php targeting the pods_admin action.
  2. The AJAX router fails to properly enforce capability checks before dispatching to privileged internal methods.
  3. An attacker can invoke privileged Pods methods — including those that modify user roles or create administrator accounts — without holding any WordPress session credentials.

This type of vulnerability is particularly severe in WordPress environments because the CMS's AJAX infrastructure (admin-ajax.php) is designed to be publicly reachable, and many plugins rely on it for both authenticated and unauthenticated flows.

Affected Versions

All versions of Pods – Custom Content Types and Fields up to and including 3.3.9 are vulnerable. The CVE was published August 15, 2026.

Mitigation

  • Update the Pods plugin immediately to the patched version available in the WordPress Plugin Repository.
  • If an immediate update is not possible, consider deactivating the plugin until the patch can be applied.
  • Audit WordPress user accounts for unauthorized administrator additions, especially if your site has been exposed with a vulnerable version.
  • Use a Web Application Firewall (WAF) to temporarily block suspicious admin-ajax.php requests targeting pods_admin actions.
  • Review WordPress security logs for anomalous role changes or new admin account creation events.

References