A critical vulnerability in the Pods – Custom Content Types and Fields plugin could let unauthenticated attackers reset administrator passwords and take over vulnerable WordPress websites. Tracked as CVE-2026-19598, the flaw affects more than 100,000 installations and has a CVSS score of 9.8. Site owners should update immediately.
Key takeaways
- CVE-2026-19598 affects Pods versions up to and including 3.3.9.
- Attackers may bypass authentication and change an administrator’s password.
- Pods 3.3.9.1 and several backported releases contain fixes.
- Website owners should update, review logs and check administrator accounts.
- A WordPress maintenance plan can help ensure security updates are applied promptly.
How the Pods vulnerability works
The issue is located in the plugin’s publicly accessible pods_admin AJAX router, which handles requests for internal administrative functions. Under normal conditions, the router should check whether a method is allowed, confirm the user is logged in, validate a WordPress nonce and verify the user’s capabilities.
Researchers found that a JSON compatibility path involving the meta-box-loader parameter could cause the plugin’s pods_error() routine to record an error without properly stopping the request. Because the calling handler continued processing, attackers could reach privileged functions despite failing the security checks.
Administrator takeover is possible
One exposed function, save_user, could reportedly be used to target an existing WordPress account and overwrite its password. An attacker would then be able to log in as the site owner or another administrator without first authenticating.
The broader router bypass may also expose other sensitive actions, including PHP file writing or arbitrary file deletion, depending on the site’s configuration and the functions available. After gaining administrator access, an attacker could install malware, create backdoors, alter content, redirect visitors or steal data.
Updates are available now
The vulnerability was discovered by security researcher Nhien Pham through the Wordfence Bug Bounty Program. The issue was disclosed to the Pods team on August 12, 2026, and fixes were released on August 14.
Administrators should install the release that matches their branch:
- 3.3.9.1
- 3.2.8.3
- 3.1.4.2
- 3.0.10.4
- 2.9.19.4
- 2.8.23.4
The developers are working with WordPress.org on forced updates, but site owners should verify the installed version rather than waiting for automatic protection.
What WordPress site owners should do
Update Pods immediately, then review administrator accounts for unexpected additions or changes. If compromise is suspected, reset privileged passwords, invalidate active sessions and inspect WordPress and server logs for unusual requests involving the plugin’s AJAX endpoint.
A WordPress care plan or maintenance plan can provide an additional layer of protection by monitoring plugin updates, checking for suspicious changes and helping investigate problems quickly. Security plugins and firewall rules are useful, but they should support—not replace—keeping every component fully patched.