A security vulnerability, tracked as CVE-2026-19598, has been identified in the Pods – Custom Content Types and Fields plugin for WordPress, a popular tool used to add custom content types and fields to WordPress sites. The flaw impacts every version of the plugin up to and including version 3.3.9. The issue stems from a coding bug that breaks the plugin’s standard security checks: these checks, which normally block unauthorized users from accessing sensitive admin functions, only log failed access attempts instead of stopping the request entirely, making all of the plugin’s built-in security guards ineffective. This gap means unauthenticated attackers — people who do not have any login credentials for your site — can exploit the flaw to gain full administrator access to your WordPress site, or overwrite the password of any user account, including the main site owner’s. This would allow an attacker to take complete control of your site, modify its content, access private data, or lock you out of your own website.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-19598
