Reported by 2 outlets
Critical WordPress Pods Flaw (CVE-2026-19598) Lets Unauthenticated Attackers Gain Admin Access
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Critical WordPress Pods Flaw Lets Unauthenticated Attackers Gain Admin Access
cyberpress.org · 50d ago · August 24th, 2026
A critical security vulnerability in the Pods WordPress plugin could allow unauthenticated attackers to seize administrator-level control of affected websites. The flaw, tracked as CVE-2026-19598, impacts all Pods versions through 3.3.9 and has received a CVSS score of 9.8, making it critical. Pods is a plugin for building custom content types, fields, and taxonomies, with more than 100,000 active installations. The vulnerability was discovered by security researcher Nhien Pham, known as nhienit, and reported through the Wordfence Bug Bounty Program. Wordfence awarded the researcher $3,900 for the submission. Critical WordPress Pods Flaw The company validated the issue on August 12, 2026, and provided the Pods development team with disclosure details through its vulnerability-management portal. At the center of the issue is Pods’ public pods_admin AJAX router. The router is intended to process internal administrative requests after performing a series of security checks. These controls are meant to verify that the requested API method is permitted, the requester is authenticated, a valid WordPress nonce is present, and the requester holds the required administrative privileges. Critical WordPress Pods Flaw (Source : Wordfence) However, the access-control logic relies on an error-handling routine, pods_error(), to halt execution when validation fails. Researchers found that a JSON compatibility path can cause this routine to log an error and return, rather than terminate the r
-
update from gbhackers.com
Critical WordPress Pods Flaw Lets Unauthenticated Attackers Gain Admin Access
gbhackers.com · 50d ago · August 24th, 2026
A critical vulnerability has been identified in the widely used Pods WordPress plugin, which could allow unauthenticated attackers to take complete control of affected websites by escalating privileges to the administrator level. This vulnerability, tracked as CVE-2026-19598, carries a CVSS score of 9.8 and affects Pods – Custom Content Types and Fields versions up to […] The post Critical WordPress Pods Flaw Lets Unauthenticated Attackers Gain Admin Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .