A broken error-handling path in the Pods WordPress plugin appears to let unauthenticated attackers bypass the access controls on the plugin's admin AJAX router, potentially escalating to Administrator or overwriting any user's password; up to and including full site takeover.
What Is It
CVE-2026-19598 is a CVSS 9.8 (CRITICAL) authorization bypass (CWE-863) in the Pods – Custom Content Types and Fields plugin for WordPress, affecting multiple release branches through 3.3.9 (see the per-branch table below for the exact affected ranges).
Per the source advisory, the pods_admin AJAX router routes its access checks, the method allowlist, nonce verification, login enforcement, and the capability gate, through pods_error(). Under the JSON meta-box-loader compatibility path, pods_error() is reported not to terminate the request: it writes the failure to the PHP error log and returns false. If execution continues past that point, the guards would be rendered ineffective and the privileged handler would run anyway. This mechanism is drawn from the advisory's description and the linked plugin source; it has not been independently reproduced here.
Why It Matters
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact across confidentiality, integrity, and availability. If exploitable as described, an unauthenticated attacker could escalate their own privileges to Administrator, overwrite the password of any account including the site owner's, or perform other administrator actions. That would amount to complete site takeover with no prerequisites beyond reaching the site.
Because failures are described as silently logged rather than blocked, exploitation attempts would leave no HTTP-level rejection; the only artifact noted in the source material is a PHP error log entry.
What's Vulnerable
Vendor sc0ttkclark, product Pods – Custom Content Types and Fields. Affected branches:
| Branch | Affected through |
|---|---|
| 2.8 | ≤ 2.8.23.3 |
| 2.9 | ≤ 2.9.19.3 |
| 3.0 | ≤ 3.0.10.3 |
| 3.1 | ≤ 3.1.4.1 |
| 3.2 | ≤ 3.2.8.2 |
| 3.3 | ≤ 3.3.9 |
All other versions are listed as unaffected by default.
Patch Status
The supplied NVD record lists no fixed version and no vendor remediation guidance; vulnStatus is Received (published 2026-08-15, awaiting NVD analysis). This CVE does not appear in the supplied CISA KEV data, so there is no confirmed active exploitation and no KEV-mandated remediation deadline on record. Operators running any affected branch above should treat the absence of a listed fix as an open exposure and consult the vendor and Wordfence advisories directly.
Sources
- NVD, CVE-2026-19598: https://nvd.nist.gov/vuln/detail/CVE-2026-19598
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/3628032a-3121-45a7-8a78-cfcd8ba6af2f?source=cve
- WordPress Plugin Source (
pods/tags/3.3.9/includes/general.php#L400): https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9/includes/general.php#L400