EUVD-2026-70903
GHSA-pgmf-2fgq-p4jp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Author role is a non-privileged authenticated user (PR:L, not PR:H); S:C and C:H retained as file reads extend outside the web application boundary.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
AnalysisAI
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must simultaneously hold: (1) the WordPress site has the Pods plugin installed at a version between 3.1.0 and 3.3.9.1 inclusive; (2) the installation is operating in restricted display-callback mode - this is the automatic default only for sites whose first-ever Pods installation predated version 3.1 (newer-origin installs are unaffected unless manually configured); and (3) the attacker possesses valid WordPress credentials at the Author role or above (Contributor and Subscriber roles are insufficient). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N scores 6.8, but the PR:H designation warrants scrutiny: WordPress's Author role is not an administrative account - it is a third-tier content contributor (Subscriber < Contributor < Author < Editor < Administrator). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Pods WordPress plugin to version 3.3.9.2 or later, which restricts the set of permissible display callback targets to an allowlist, closing the unrestricted callable resolution. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding t
Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote atta
The Pods - Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cros
The Pods - Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cros
The Pods - Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in
The Pods - Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all vers
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privi
Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods - Custom Content Types and Fields plugin <=
Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject a
Unauthenticated reflected/stored cross-site scripting in the Pods WordPress plugin (versions 3.3.8 and earlier) allows r
The Pods - Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions u
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, al
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today