6.8
Medium
CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to,…
Description
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Pods 3.1 | 3.1.0 → < 3.3.9.2 | 3.3.9.2 |
Other CVEs of Pods
The 5 CVEs of Pods →
CVE-2026-74851
The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked…
7.2
High
CVE-2025-1446
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement,…
4.1
Medium
CVE-2024-11849
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high…
6.1
Medium
CVE-2024-9883
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high…
4.8
Medium