6.8
Moyenne
CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to,…
Description
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Pods 3.1 | 3.1.0 → < 3.3.9.2 | 3.3.9.2 |
Autres CVE de Pods
Les 5 CVE de Pods →
CVE-2026-74851
The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked…
7.2
Élevée
CVE-2025-1446
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement,…
4.1
Moyenne
CVE-2024-11849
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high…
6.1
Moyenne
CVE-2024-9883
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high…
4.8
Moyenne