EUVD-2026-66277
GHSA-hqrq-6pwc-6v3j
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable via WordPress interface but requires author-level credentials (PR:H); arbitrary PHP execution justifies full C/I/A with unchanged scope.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
AnalysisAI
Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding the author role or higher to invoke arbitrary PHP functions on the server by submitting a crafted display callback that bypasses the plugin's blocked-function comparison logic. Exploitation is limited to sites where restricted display-callback mode is active - the automatic default on installations first deployed on Pods versions predating 3.1 - meaning a large subset of long-running Pods deployments are in-scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three simultaneous conditions: (1) the Pods WordPress plugin must be installed and active in a version between 3.1.0 and 3.3.9.1; (2) restricted display-callback mode must be enabled - this is the automatic default only for installations whose first Pods version predated 3.1, meaning newer clean installs are NOT affected by default; (3) the attacker must hold at minimum a WordPress author-level account (PR:H per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H captures the network exploitability and severe code-execution impact accurately, but the PR:H designation is the key limiting signal: exploitation cannot be achieved without at minimum a WordPress author-level account, which meaningfully reduces casual attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a WordPress author account on a target site running Pods 3.1.0-3.3.9.1 with restricted display-callback mode active submits a crafted display callback value that exploits the blocklist comparison flaw. The malformed callback name passes the flawed check and is executed by the server as arbitrary PHP code. … |
| Remediation | Upgrade the Pods WordPress plugin to version 3.3.9.1 or later, which corrects the flawed blocked-function comparison (vendor-released patch confirmed via WPScan advisory https://wpscan.com/vulnerability/4972f315-3819-4fb9-b56a-a88df992416e/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify those running Pods plugin versions 3.1.0-3.3.9.1 and determine which have restricted display-callback mode enabled in Pods settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote atta
The Pods - Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cros
The Pods - Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cros
The Pods - Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in
The Pods - Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all vers
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privi
Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods - Custom Content Types and Fields plugin <=
Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject a
Unauthenticated reflected/stored cross-site scripting in the Pods WordPress plugin (versions 3.3.8 and earlier) allows r
The Pods - Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions u
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, al
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privi
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today