If your site runs the Pods plugin, update it today. A critical flaw lets an attacker take over your site without ever logging in.
What happened
Pods, a plugin used to build custom content types and fields, has an unauthenticated privilege escalation vulnerability. Wordfence says the flaw lets an attacker escalate to administrator and take actions like overwriting the password on any account, including the site owner’s. That hands the attacker complete control of the site.
The bug sits in how Pods checks permissions on its admin AJAX requests. Every access check, including login enforcement and capability checks, routes through a function that is supposed to stop the request when a check fails. Under one compatibility path, that function only writes the failure to a server log instead of actually blocking the request, so the checks never stop anything. An attacker can walk straight through.
The flaw is tracked as CVE-2026-19598 and rated 9.8 out of 10, a critical score. Researcher Nhien Pham reported it through the Wordfence Bug Bounty Program on August 10, 2026, and earned a $3,900 bounty.
Who is affected
Every site running Pods version 3.3.9 or earlier is vulnerable. The plugin has more than 100,000 active installations. Wordfence Premium, Care, and Response users received a firewall rule blocking known exploits on August 12, 2026. Sites on the free version of Wordfence will not get that protection until September 11, 2026, so anyone running the free firewall is exposed for a full extra month.
What to do
Update Pods to version 3.3.9.1 or later right away. If you cannot update immediately, check your user accounts for any administrator you don’t recognize and review recent password changes, since a successful attack would leave those traces behind.
End of article