A critical security flaw in the popular Pods – Custom Content Types and Fields WordPress plugin can be exploited by anyone on the internet — no account required — to seize full administrator control of a WordPress site. Tracked as CVE-2026-19598, the privilege escalation vulnerability carries a CVSS score of 9.8 out of 10 and affects all plugin versions up to and including 3.3.9. With over 100,000 active installations, the exposure is significant.
An attacker who successfully exploits the flaw can escalate their privileges to Administrator or overwrite the password of any existing user account, including the site owner’s, leading to complete site takeover. Because authentication is not required, the attack can be launched by anyone who can reach a target site’s WordPress installation. Wordfence, which discovered and reported the vulnerability, notes that it issued a firewall rule to protect users of its premium tier immediately upon discovery.
How to check if you’re affected
Affected versions of the Pods plugin are all releases up to and including 3.3.9. If your WordPress dashboard shows Pods – Custom Content Types and Fields at version 3.3.9 or older, your site is at risk. Navigate to Plugins → Installed Plugins in your WordPress admin panel and check the version number listed next to Pods. Update to the latest available version immediately via the dashboard or through wp plugin update pods on the command line. Sites running any version up to 3.3.9 should treat this as an urgent patch.