Unauthenticated privilege escalation in Pods WordPress plugin AJAX router (CVE-2026-19598)
With Wordfence and Patchstack both reporting in-the-wild exploitation, two public exploits, and a VulnCheck KEV listing from the past three days, unpatched Pods sites face unauthenticated admin takeover this week.
The pods_admin AJAX router funnels every access check — method allowlist, nonce verification, login enforcement, and capability gates — through pods_error(), which under the JSON meta-box-loader compatibility path merely logs failures and returns false instead of terminating the request. Unauthenticated attackers can therefore invoke admin-only methods and escalate to full site compromise.
Affected: Pods 2.8 – 2.8.23.3; Pods 2.9 – 2.9.19.3; Pods 3.0 – 3.0.10.3; Pods 3.1 – 3.1.4.1; Pods 3.2 – 3.2.8.2; Pods 3.3 – 3.3.9
How to Test
Run 'wp plugin list' or check Plugins in wp-admin to confirm the Pods version; grep web server access logs for unauthenticated POSTs to admin-ajax.php with action=pods_admin, and check the PHP error log for pods_error entries indicating swallowed authorization failures; audit wp_users for unexpected administrator accounts.
How to Patch
Update Pods to 3.3.9.1 (or the corresponding patched release for your branch) immediately; if you cannot update today, deactivate the plugin or block admin-ajax.php requests with action=pods_admin from unauthenticated sources at the WAF.