Published on 4 September 2026
An attacker who doesn't even need a user account can exploit a critical vulnerability in the widely used WordPress plugin Pods to overwrite the password of any account – including that of the site owner. The result: complete takeover of the website. The vulnerability carries the identifier CVE-2026-19598, is rated at the highest possible severity of CVSS 9.8 (critical), and is already being actively exploited. Wordfence, a provider of WordPress security solutions, reported 12,357 blocked attacks within just 24 hours when checked on 22 August 2026. If you use the Pods plugin, you should act now.
The affected plugin is “Pods – Custom Content Types and Fields”, which lets you create custom content types and fields in WordPress. Wordfence puts its distribution at more than 100,000 active installations. Security researcher Nhien Pham reported the vulnerability on 10 August 2026 through Wordfence's bug bounty programme – a programme in which researchers are rewarded for reported vulnerabilities. After validation on 12 August, Wordfence informed the vendor, who released corrected versions as early as 14 August 2026.
The core of the problem is faulty authorisation – that is, a situation in which software should check whether access is permitted but fails to do so effectively. István Márton of Wordfence describes the impact clearly in the primary report:
„This vulnerability allows unauthenticated attackers to escalate their privileges to administrator and perform various administrator actions, such as overwriting the password of any user account, including the site owner’s, resulting in complete site takeover.“ (This vulnerability allows unauthenticated attackers to escalate their privileges to administrator level and perform various administrator actions – such as overwriting the password of any account, including the site owner's, resulting in complete takeover of the website.) – Wordfence, 21.08.2026
The vulnerability is classified as “Incorrect Authorization” (CWE-863), i.e. flawed access control. Pods provides a publicly reachable AJAX handler named pods_admin. AJAX is a technique that allows the website to exchange data with the server in the background without reloading the page. This handler forwards requests to internal, sometimes privileged functions.
Before such functions are executed, several checks should apply: Is the called method permitted? Is the user logged in? Is the so-called nonce correct – a one-time security token that safeguards requests? And does the user have the necessary permissions? This is precisely where the flaw lies: these checks run through a function called pods_error(). When Pods detects a certain JSON request in the meta-box compatibility path, pods_error() does log an error – but does not terminate the request. Since the calling function does not evaluate this return value, the request simply continues despite the failed checks. Unauthenticated attackers can thus reach privileged functions that are actually reserved for administrators.
Particularly explosive: it's not just about passwords. Márton points out that the bypassed access control opens up further functions:
„Because the flaw defeats the access controls on the pods_admin router as a whole, other privileged API methods are exposed as well, which could be used to write PHP to a file, delete arbitrary files, or perform other administrator-level actions.“ (Because the flaw defeats the access controls of the pods_admin router as a whole, other privileged API methods are also exposed, which could be used to write PHP code to files, delete arbitrary files, or perform other administrator-level actions.) – István Márton, Wordfence
The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H sums up the danger: the attack is possible over the network (AV:N), with little effort (AC:L), without an account (PR:N), and without a victim having to click anything (UI:N). Confidentiality, integrity and availability can each be severely impaired.
Affected are websites with the Pods plugin installed and active in a vulnerable version. The vulnerability affects several version branches up to their respective unpatched end states:
Important for context: the figure of more than 100,000 installations is a distribution figure – not a number of compromised websites, affected companies or exposed datasets. For this specific case, no reliable figure of successful takeovers has been published in the primary and official sources reviewed. Nevertheless, haste is called for, because the active attack attempts are real. The CISA KEV catalogue (a US list of known, actively exploited vulnerabilities) did not yet contain an entry as of 22 August 2026 – but that does not refute the observed attacks.
wp plugin list --name=pods shows the installed and active version. This is a pure version check – not an attack test.The vendor is unequivocal. Scott Kingsley Clark of Pods writes in the announcement of 14 August 2026:
„Today we have released security patches across every major version starting at Pods 2.8+. If you are running any version of Pods, we strongly recommend updating as soon as possible.“ (Today we have released security patches for every major version from Pods 2.8 onwards. If you are running any version of Pods, we strongly recommend updating as soon as possible.)
wp plugin update pods.Note: This is general context and not legal advice. An unpatched Pods plugin alone is not yet a proven data breach. However, if an attacker gains unauthorised access to personal data, or if such data is altered, disclosed, lost or made inaccessible, this may constitute a reportable breach of the protection of personal data.
The EDPB (European Data Protection Board) explains for small and medium-sized enterprises: All data breaches must be documented. Controllers must in principle inform the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware – unless a risk to the rights and freedoms of natural persons is unlikely. Where there is likely to be a high risk, the affected individuals must be notified without undue delay. A processor must inform the controller without undue delay.
In practical terms, this means: document the time of becoming aware, the indicators, the categories of data, potentially affected individuals, your risk assessment, and the measures taken. Then have the specific reporting and notification obligations assessed based on the actual investigation results by data protection officers or qualified legal counsel.
Documented EDPB cases from 2025 show that inadequate technical and organisational measures under Article 32 GDPR can be penalised – a fine of 81,000 euros after a ransomware incident with an inadequate risk analysis, as well as 1.7 million euros against NEXPUBLICA FRANCE after unauthorised access to third-party documents. These cases are not a fine forecast for Pods operators, but they illustrate that security, response and communication are decisive.
Patchstack's security analysis of the WordPress ecosystem for 2025 cites a weighted median of around five hours until mass exploitation of heavily attacked vulnerabilities; about half of the high-impact vulnerabilities were attacked within 24 hours. This is an industry analysis and not a measurement specific to CVE-2026-19598 – but the message for operators remains the same: for critical, actively exploited vulnerabilities, whoever patches quickly wins.
CVE-2026-19598 is a critical authorisation vulnerability that can lead to complete takeover of affected WordPress websites without an account and without user interaction. With over 100,000 installations, active attack attempts and a CVSS score of 9.8, it is one of those cases where delay can become costly. The good news: the vendor already provided patched versions for all affected branches on 14 August 2026.
Your priorities are clear: check the version, update immediately to at least 3.3.9.1 (or the appropriate backport) – and, if your website was previously vulnerable and publicly reachable, check for indicators of compromise. Because an update closes the vulnerability but does not remove any administrator access already created. The BSI sums it up for companies in an emergency: “Is your company affected by an IT security incident? Then it's time to act without delay.”