Pods' Solo Developer Raced to Patch a Critical Flaw Across Six Plugin Versions

Last week we covered a critical flaw in the Pods plugin that let attackers become your site admin without logging in. New reporting on how that fix came together shows just how much work went into protecting the plugin’s 100,000-plus sites.

What happened

Wordfence disclosed the CVSS 9.8 vulnerability on August 21, crediting researcher Nhien Pham, who reported it through the company’s Bug Bounty Program on August 10 and earned a $3,900 bounty. The bug traces back to a compatibility fix Pods added years ago for the Block Editor: instead of blocking a request when a security check failed, a function just logged the failure and let the request continue. That meant any request could walk past every security check in the plugin’s admin handler, including login and capability checks, and reach admin-level functions such as resetting any user’s password without authentication.

Pods is maintained by a single primary developer, Scott Kingsley Clark, a Senior Software Development Engineer at GoDaddy who works on the free plugin in his own time. When Wordfence contacted him on August 12, he took the rest of the week off his day job to respond. He set an AI agent loose on the codebase to look for related issues while reviewing the code himself, and it turned up several more bugs that also got fixed.

The fix itself was small, but shipping it wasn’t. Clark had to backport the patch across six major versions of Pods, going back to version 2.8, each tested against different combinations of PHP and WordPress to avoid breaking sites on auto-update. The resulting release, version 3.3.9.1, bundles 16 security fixes credited to five researchers, with 13 fixes in each of the five backported versions.

Why it took longer than expected

Clark also had to work through WordPress.org’s “Protect the Shire” initiative, which holds new plugin and theme releases for several hours before they go live. He’d been looking for a way around the hold when he noticed a message pointing him to WordPress.org’s Plugins Team for direct help getting the security release through faster.

What to do

If you already updated Pods to version 3.3.9.1 or a matching backported release after last week’s report, you’re covered. If you haven’t, update now: the flaw allows complete site takeover, and the fix also closes several additional issues found during the review.

End of article