A critical vulnerability in the Pods WordPress plugin could let attackers access administrator-level functions without logging in. Tracked as CVE-2026-19598 and rated 9.8 out of 10, the flaw affects more than 100,000 installations. Website owners should update immediately and check for signs of unauthorised access.
Key takeaways
- CVE-2026-19598 affects Pods versions up to and including 3.3.9.
- Unauthenticated attackers may reset an administrator’s password.
- Pods 3.3.9.1 and several older-branch releases contain fixes.
- Site owners should update, review logs and audit administrator accounts.
- A WordPress maintenance plan can help ensure security updates are not missed.
How the Pods vulnerability works
The issue is located in Pods’ publicly accessible pods_admin AJAX router, which handles internal administrative requests. Normally, the router should confirm that a method is allowed, the visitor is logged in, a valid WordPress nonce is supplied and the account has the necessary permissions.
Researchers found that a JSON compatibility path involving the meta-box-loader parameter could cause the plugin’s error-handling function to record a failure without stopping the request. The router then continued processing attacker-controlled input despite the failed security checks.
Password resets could lead to full takeover
One exposed function, save_user, can be used to change the password of an existing WordPress account. An attacker could potentially target a site owner or administrator, log in with the new password and take control of the website.
The risk may extend beyond account takeover. Once inside, an attacker with administrator privileges could install a malicious plugin, alter content, create backdoors, redirect visitors or access sensitive information. Other administrative operations may also permit PHP file writes or arbitrary file deletion, depending on the site configuration.
Fixed versions and security response
Pods released version 3.3.9.1 on 14 August 2026. Security fixes were also backported to the following branches:
- 2.8.23.4
- 2.9.19.4
- 3.0.10.4
- 3.1.4.2
- 3.2.8.3
Wordfence provided firewall protection to its Premium, Care and Response customers after validating the report. Protection for free users was scheduled for 11 September 2026. Firewall rules can reduce exposure, but they should not replace updating the vulnerable plugin.
What WordPress site owners should do
Update Pods through the WordPress dashboard or the official plugin repository, then confirm that the installed version is fixed. If compromise is possible, reset administrator passwords, review user accounts and check for unfamiliar plugins, themes, PHP files or content changes.
It is also worth reviewing server and WordPress logs for unusual requests to the Pods AJAX endpoint. A WordPress care plan can provide an extra layer of protection by monitoring updates, backups, security activity and site health, helping busy site owners respond before a vulnerability becomes a business-impacting incident.