Description

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-26T06:16:26.830Z",
  "pubdate": "2026-08-26T06:16:26.830Z",
  "executiveSummary": "The Pods WordPress plugin versions prior to 3.3.9.1 are susceptible to an Arbitrary Code Execution vulnerability stemming from an inadequate security validation mechanism regarding display callbacks.\nThis vulnerability is specifically localized to installations operating under the restricted display-callback mode, which acts as the default configuration for legacy installations where the initial Pods version predates 3.1.\nBy bypassing the blocklist filtering mechanism, an authenticated user with the author role or higher can execute arbitrary PHP functions on the underlying server. This represents a critical security risk, as it allows for complete system compromise, unauthorized data access, and persistent backdooring of the host environment.\nExploitation requires the attacker to have an authenticated session with sufficient privileges (Author or above) and relies on the targeted site utilizing the legacy default restricted mode.\nThe absence of a robust, positive-security model for callback validation allows for the execution of unauthorized functions that should otherwise be prohibited by the plugin's security policy.",
  "technicalDetails": "The vulnerability originates from a flaw in the input sanitization and validation logic within the Pods plugin's callback processing engine. Specifically, when the plugin operates in restricted display-callback mode, it utilizes a blocklist-based approach to filter user-supplied callback functions. The implementation fails to perform a rigorous comparison between the user-provided callback input and the list of prohibited functions.\nBecause the validation check is insufficient, an attacker can supply malicious function signatures or bypass the filtering criteria through obfuscated or unexpected string representations that the validation routine fails to identify correctly. This lack of exhaustive input canonicalization allows an attacker to bypass the intended security restrictions designed to prevent the execution of arbitrary server-side code.\nThe attack flow proceeds as follows: An authenticated user with at least Author-level permissions accesses the Pods plugin interface where display callbacks can be defined. The attacker submits a crafted request containing a payload targeting a function that is intended to be blocked by the restricted mode. Due to the failure in the comparison logic, the application processes the provided callback without correctly flagging it as forbidden. Subsequently, the plugin's execution engine triggers the execution of the requested function within the context of the web server process.\nThe primary component affected is the callback validation handler, which fails to enforce the defined security policy. Because this is a logic flaw in code execution, the impact is severe. An attacker can leverage this to execute system commands, access the WordPress database, exfiltrate sensitive configuration files, or modify application files to establish persistent unauthorized access.\nThe vulnerability is present in versions of the Pods plugin prior to 3.3.9.1. Exposure is limited to those sites where the restricted display-callback mode is active. This state is persistent on legacy installations where the plugin was first activated on a version older than 3.1. Installations that migrated or were initialized on newer versions may have different default security postures, but it is critical to verify the current configuration against the updated plugin logic in 3.3.9.1."
}