Vulnerability in Pods WordPress Plugin Allows Unauthorized File Access
CVE-2026-74853
Key Information:
Badges
What is CVE-2026-74853?
The Pods WordPress plugin versions earlier than 3.3.9.2 have a vulnerability that permits users with the author role and higher to access unauthorized files on the server. This occurs due to insufficient restrictions on display callback functions, enabling the retrieval of arbitrary files, including sensitive data outside the web root. This issue primarily impacts sites using the restricted display-callback mode, which is the default setting for installations with initial Pods versions before 3.1. Proper updates and security practices are essential to mitigate this risk.
Affected Version(s)
Pods 3.1.0 < 3.3.9.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.