7.2
Élevée
CVE-2026-74851 The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked…
Description
The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Pods 3.1 | 3.1.0 → < 3.3.9.1 | 3.3.9.1 |
Autres CVE de Pods
Les 5 CVE de Pods →
CVE-2026-74853
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to,…
6.8
Moyenne
CVE-2025-1446
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement,…
4.1
Moyenne
CVE-2024-11849
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high…
6.1
Moyenne
CVE-2024-9883
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high…
4.8
Moyenne