External risk intelligence

WordPress Pods Plugin Privilege Escalation via Authorization Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-19598

This vulnerability affects a WordPress plugin. WordPress sites are frequently deployed as public-facing web applications, and the vulnerable AJAX router path is reachable via the public internet as part of standard site operations.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects the Pods plugin for WordPress, allowing unauthenticated attackers to gain administrator privileges or reset any user's password. This could lead to a complete takeover of a WordPress website.

Unauthenticated users can take over WordPress sites.
Affects a popular WordPress plugin, increasing potential exposure.
Focus on confirming relevance and exposure for your WordPress instances.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to the WordPress site. This request bypasses security checks due to a flaw in how the plugin handles errors, allowing an unauthenticated user to gain administrator privileges. Successful exploitation could lead to complete control of the website.

No authentication required.
Bypasses security checks via AJAX.
Full site takeover.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could escalate privileges to Administrator or overwrite any user's password, enabling complete site takeover or other administrator actions, when supported by the advisory.

User account access and site control.
Authorization bypass via AJAX router.
Complete site takeover or data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Pods plugin affects WordPress sites, potentially allowing unauthenticated attackers to gain administrator privileges or reset any user's password, leading to a complete site takeover. Identifying affected sites, confirming their exposure and business criticality, and assigning ownership for remediation are the immediate priorities.

WordPress site owners and platform teams own this.
Verify plugin usage and external reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Pods plugin for WordPress?

Pods is a WordPress plugin used to create and manage custom content types, fields, and taxonomies. It allows site administrators to extend the default WordPress data structure, enabling more complex content organization and custom display options beyond standard posts and pages.

What does CWE-863 mean for CVE-2026-19598?

CWE-863 refers to Incorrect Authorization. In this CVE, the plugin fails to properly verify if a user has the right to perform a specific action. Because the AJAX router does not stop the process when security checks fail, it treats unauthorized requests as if they were permitted, granting attackers access to administrative functions.

How does an attacker trigger this vulnerability?

An attacker sends a crafted network request to the site's AJAX endpoint. The vulnerability is triggered when the request hits the specific JSON meta-box-loader path. Importantly, simply browsing the site or using standard plugin features does not trigger this; the attacker must intentionally send a request formatted to exploit the flawed error handling.

Why should I care about this CVE?

According to Halo Surface Signal, this plugin is often used on public-facing WordPress sites. Because the flaw is reachable over the internet without requiring a login, any site using an affected version is potentially at risk of unauthorized administrative takeover, regardless of whether the site is for internal or public use.

What should I do if I use Pods on my site?

First, identify if you are running a version of the Pods plugin up to and including 3.3.9. If you are, check the official plugin repository for a patched version. Until you can update, you may need to temporarily deactivate the plugin to prevent potential site takeover attempts while you plan your maintenance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.