SECUFOCUSNOW
Home›CVE index›CVE-2026-19598
ReviewCritical

CVE-2026-19598

sc0ttkclark Pods – Custom Content Types and Fields

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthen...

CVSS
9.8
EPSS
2.79%
85.4% percentile
CISA KEV
Not listed
Published
2026.08.16
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability2.79%
Technical severityCVSS 9.8

Vulnerability overview

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthen...

Affected product and versions

Product
sc0ttkclark Pods – Custom Content Types and Fields
Affected versions
>= 2.8 <= 2.8.23.3, >= 2.9 <= 2.9.19.3, >= 3.0 <= 3.0.10.3, >= 3.1 <= 3.1.4.1, >= 3.2 <= 3.2.8.2, >= 3.3 <= 3.3.9
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that sc0ttkclark Pods – Custom Content Types and Fields and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-863