A security flaw tracked as CVE-2026-19598 affects the Pods – Custom Content Types and Fields plugin for WordPress, a tool used to build custom content types and fields for WordPress sites. The vulnerability impacts all versions of the plugin up to and including 3.3.9. The flaw exists because the part of the plugin that handles admin requests is supposed to run multiple security checks (including verifying a user is logged in, has the correct permissions, and that the request is valid) before allowing access to sensitive admin functions. However, a bug in a compatibility path for older JSON meta box loading causes these checks to fail silently: instead of blocking unauthorized requests, the plugin only writes the failure to the server's error log and allows the request to continue, rendering all access guards ineffective. This makes it possible for unauthenticated attackers (people who do not have any login credentials for your site) to exploit the flaw to escalate their privileges to full site administrator, overwrite the password of any user account on the site (including the site owner's), take over the entire site, or perform other actions that are normally restricted to administrators.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-19598
