CVE-2026-19598: Critical Pods Plugin Flaw Lets Attackers Reset Admin Passwords
A WordPress site administrator’s password could be changed by an attacker without ever logging in. A critical vulnerability in the popular Pods plugin allowed an unauthenticated outsider to bypass several layers of security checks in sequence and reach administrative functionality directly. According to Wordfence, in the worst case, an attacker could seize complete control of a site.
A Widely Used Plugin, Broadly Affected
Pods helps WordPress site owners create custom content types, fields, and taxonomies, while also linking different records together. The plugin has more than 100,000 active installations. The issue affects every Pods branch starting from version 2.8, spanning all versions through 3.3.9 inclusive.
CVE-2026-19598: Critical, Unauthenticated, Remote
The vulnerability is tracked as CVE-2026-19598, carrying a severity score of 9.8. Exploiting it requires no account, no prior access to the site, and no interaction from an administrator whatsoever. The attack can be carried out entirely remotely over the network, which is precisely why it was classified at the critical severity level.
How a Broken Error Check Bypassed Security
The flaw resided within the pods_admin AJAX router, through which the plugin accesses internal administrative functions. Before executing a request, Pods is supposed to verify the allowed method, confirm authorization, validate a one-time protective nonce, and check user permissions. If any of these checks failed, the plugin was designed to call its pods_error() function, which was meant to halt request processing entirely.
However, when processing JSON in one particular mode, this function behaved differently. Rather than immediately stopping execution, pods_error() logged a message to the PHP error log and returned a value of false. The router’s code failed to check that returned value and simply continued executing. As a result, a request could proceed even after its authentication, nonce validation, or permission check had already failed.
From Broken Validation to Full Site Takeover
Wordfence’s researchers demonstrated that this failure opened access to Pods’ internal methods. Through the function responsible for saving user records, an attacker could specify an existing account and overwrite its password. By targeting the site’s administrator account, an attacker could effectively gain complete control over the entire WordPress installation. The flaw’s impact extended beyond user management alone – by bypassing the security checks, an attacker could also perform other administrative operations, including modifying files, deleting data, and taking actions capable of resulting in PHP code execution.
Discovery, Disclosure, and Patch Timeline
Security researcher Nguyen Pham discovered the vulnerability and submitted it through the Wordfence Bug Bounty Program on August 10. Wordfence confirmed the issue on August 12 and notified the Pods development team that same day. The researcher received a $3,900 bounty for the finding. By August 14, the project team had already released patched builds.
According to the developers’ official update announcement, they spent an additional 36 hours reviewing several related sections of code and closed a number of other potential issues in the process. Version 3.3.9.1 included 16 changes aimed at strengthening security overall, and backported fixes containing 13 core changes were prepared for older branches.
Patched Versions and Forced Updates
Versions considered secure are Pods 3.3.9.1, 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, and 2.8.23.4. The Pods development team, working with the WordPress.org team, forced vulnerable installations to automatically update to the patched version of their corresponding branch. While this approach should reduce the overall number of unprotected sites, administrators are still advised to independently verify their installed version, since the automatic update process may not have completed successfully on every system.
Active Exploitation Already Underway
The danger has already moved well beyond theoretical. Wordfence’s live threat intelligence page reports 28,540 blocked attempts to exploit CVE-2026-19598 within the past 24 hours alone. Site owners running Pods should verify their plugin version as soon as possible – even if WordPress previously reported that an automatic update had already taken place.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
