A security flaw has been identified in the Pods plugin for WordPress, a tool used to build custom content types and fields for websites. The flaw impacts all versions of the plugin up to 3.3.9. It stems from a bug in how the plugin handles certain site requests: all of its security checks (including verifying if a user is logged in and has permission to access a feature) are routed through a function that only logs failed checks to the site's error log instead of blocking the request entirely, making all security guards useless.
This flaw allows attackers who do not have an existing login for your site to exploit it. They can grant themselves full administrator access to your WordPress site, or change the password for any user account on the site, including the main account belonging to the site owner. If successfully exploited, this would let an attacker take complete control of your entire website and make any changes they want.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-19598
