Pods WordPress Plugin CVE-2026-74851

Exploitation requires three simultaneous conditions: (1) the Pods WordPress plugin must be installed and active in a version between 3.1.0 and 3.3.9.1; (2) restricted display-callback mode must be enabled - this is the automatic default only for installations whose first Pods version predated 3.1, meaning newer clean installs are NOT affected by default; (3) the attacker must hold at minimum a WordPress author-level account (PR:H per CVSS vector). Sites first installed on Pods 3.1 or later with default settings, or sites without any untrusted author-level accounts, are not exploitable. User interaction is not required (UI:N), but the need for an authenticated author account limits exploitation to insiders or attackers who have separately compromised credentials. These three conditions substantially narrow the real-world exploitable population beyond what the 7.2 CVSS score alone implies.

The CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H captures the network exploitability and severe code-execution impact accurately, but the PR:H designation is the key limiting signal: exploitation cannot be achieved without at minimum a WordPress author-level account, which meaningfully reduces casual attack surface. EPSS at 0.21% (11th percentile) is consistent with this - the public exploit exists but practical exploitation requires account access, suppressing mass scanning utility. This CVE is not in CISA KEV, confirming no confirmed widespread in-the-wild campaigns at time of analysis. The highest real-world risk belongs to sites that: (1) have been running Pods since before version 3.1 (restricted mode is active by default), and (2) allow untrusted third parties to register as contributors or authors. Sites with tightly controlled contributor rosters face substantially lower risk. CVSS alone would overstate urgency for most deployments.

An attacker with a WordPress author account on a target site running Pods 3.1.0-3.3.9.1 with restricted display-callback mode active submits a crafted display callback value that exploits the blocklist comparison flaw. The malformed callback name passes the flawed check and is executed by the server as arbitrary PHP code. A public exploit is available per WPScan intelligence, lowering the skill barrier for exploitation once account access is obtained.