Description

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T18:16:23.860Z",
  "pubdate": "2026-08-15T18:16:23.860Z",
  "executiveSummary": "The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to an authorization bypass leading to privilege escalation, affecting all versions up to and including 3.3.9.\nThe flaw stems from improper handling of access checks within the AJAX routing mechanism, specifically when interacting with the JSON meta-box-loader compatibility path.\nThis architectural failure allows unauthenticated remote attackers to completely bypass critical security controls, including method allowlists, nonce verifications, login enforcement, and capability gates.\nSuccessful exploitation grants unauthenticated attackers the ability to escalate privileges to Administrator, overwrite passwords for any user account including the site owner, execute administrative actions, and achieve complete site takeover.\nGiven the severity of potential impacts and the lack of authentication requirements, this vulnerability represents a critical risk to affected WordPress deployments utilizing vulnerable versions of the Pods plugin.",
  "technicalDetails": "The vulnerability resides within the AJAX routing mechanism of the Pods – Custom Content Types and Fields plugin, specifically in the pods_admin AJAX router component affecting all plugin versions up to and including 3.3.9.\nThe root cause of the vulnerability is an authorization bypass flaw tied to error handling and flow control. The pods_admin router funnels every security and access check through the pods_error() function.\nWhen processing requests via the JSON meta-box-loader compatibility path, pods_error() deviates from standard security protocols by merely writing failures to the PHP error log and returning a false boolean value instead of terminating execution or halting the request lifecycle.\nConsequently, all security guards—encompassing method allowlists, cryptographic nonce verification, login enforcement, and capability gates—are rendered entirely ineffective, allowing unauthorized execution of restricted administrative functions.\nThe attack flow begins with an unauthenticated remote attacker sending a crafted AJAX request targeting the vulnerable pods_admin routing endpoint while invoking the JSON meta-box-loader compatibility path.\nBecause the access checks fail silently and execution continues, the attacker can supply parameters designed to execute administrative actions.\nThese actions include escalating the attacker's privileges to Administrator or directly overwriting the password of any existing user account, including privileged accounts such as the primary site owner.\nThe post-exploitation impact of this vulnerability is critical, resulting in complete site takeover, arbitrary administrative code execution, and total compromise of the underlying WordPress environment."
}