Description

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-04T07:17:09.713Z",
  "pubdate": "2026-09-04T07:17:09.713Z",
  "executiveSummary": "The Pods WordPress plugin, in versions prior to 3.3.9.2, contains a critical security vulnerability involving improper restriction of display callbacks. This flaw facilitates an Arbitrary File Read (AFR) vulnerability, allowing authenticated users with the 'author' role or higher to access sensitive files on the underlying host filesystem.\nThe vulnerability manifests specifically in installations configured with the 'restricted display-callback' mode, which is the default for environments where the initial Pods installation predated version 3.1. By manipulating the display callback functionality, an attacker can bypass intended access controls to read arbitrary local files, including those located outside of the designated web root directory.\nThe risk implications are severe, as this capability potentially allows for the exfiltration of sensitive configuration files, including wp-config.php, which contains database credentials, authentication unique keys, and salt values. Successful exploitation may lead to full site compromise, privilege escalation, or further lateral movement within the server environment. Mitigation requires upgrading the plugin to version 3.3.9.2 or later to enforce stricter validation on callback resolution.",
  "technicalDetails": "The vulnerability originates from an insufficient validation mechanism within the Pods plugin's display callback architecture. Specifically, the plugin fails to maintain an allowlist or perform adequate sanitization when resolving callback functions defined by user input. In the affected 'restricted display-callback' mode, the system is designed to limit the scope of accessible functions; however, the implementation does not sufficiently prevent the invocation of internal PHP functions or callbacks that can be leveraged to traverse the filesystem or manipulate file read operations.\nThe attack flow begins when an authenticated user (with author-level permissions or higher) interacts with a Pods-related interface that accepts callback parameters. By injecting a crafted payload into the display-callback parameter, the attacker forces the application to execute a function that returns the contents of a targeted file. Because the application logic does not restrict the path resolution process to the web root, the attacker can use directory traversal techniques (e.g., ../ sequences) to point the callback to sensitive system files, such as /etc/passwd or critical WordPress configuration files.\nThe exploitation mechanism relies on the underlying PHP execution environment. If the resolved function is capable of file stream access—or if the callback mechanism is susceptible to type confusion where a string argument can be coerced into a file path—the application will perform a read operation on behalf of the attacker and output the file's contents back through the WordPress user interface. This bypasses typical filesystem permissions granted to the web user, assuming the PHP process has read access to the target files.\nBecause this vulnerability is restricted to installations that maintain the legacy 'restricted display-callback' mode (predating Pods 3.1), administrators who migrated or performed clean installs after this threshold may not be susceptible. However, for legacy sites, the lack of a strict functional registry or callback whitelist remains the root cause. The impact of successful exploitation is significant, potentially resulting in the unauthorized disclosure of proprietary code, environmental variables, and database credentials, effectively granting the attacker full oversight of the WordPress instance and its associated backend database infrastructure."
}