7.2
High
CVE-2026-74851 The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked…
Description
The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Pods 3.1 | 3.1.0 → < 3.3.9.1 | 3.3.9.1 |
Other CVEs of Pods
The 5 CVEs of Pods →
CVE-2026-74853
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to,…
6.8
Medium
CVE-2025-1446
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement,…
4.1
Medium
CVE-2024-11849
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high…
6.1
Medium
CVE-2024-9883
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high…
4.8
Medium