CVE-2026-19598

Published Aug 15, 2026

Last updated 7 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-19598 describes an unauthenticated privilege escalation vulnerability found in the Pods – Custom Content Types and Fields plugin for WordPress, affecting all versions up to and including 3.3.9. The flaw resides within the `pods_admin` AJAX router, where security checks such as method allowlisting, nonce verification, login enforcement, and capability gates are funneled through the `pods_error()` function. Under the JSON meta-box-loader compatibility path, `pods_error()` may only log failures and return false instead of terminating the request, rendering these security controls ineffective. This bypass allows unauthenticated attackers to perform administrative actions, including escalating their privileges to Administrator or overwriting the password of any user account, potentially leading to a complete site takeover.

Description: The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.
Source: security@wordfence.com
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-863

Hype score: Not currently trending

References