The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass. The flaw lies in the pods_admin AJAX router, which treats any request as a failure through pods_error() when the JSON meta‑box‑loader path is used, thereby ignoring all access checks, capability gates, nonce verification, and login enforcement. This allows an attacker to call administrative methods and even overwrite user passwords, effectively gaining Administrator privileges.

WordPress sites that have the Pods plugin installed with a version of 3.3.9 or earlier are affected. The plugin is distributed by sc0ttkclark under the name Pods – Custom Content Types and Fields.

The CVSS score of 9.8 marks this flaw as critical, and the EPSS score is not available, but the vulnerability is known to be exploitable by unauthenticated attackers over HTTP. Because the bypass occurs in an AJAX router that is publicly accessible, an attacker can trigger it with a simple GET or POST request without needing any credentials. The flaw is not yet listed in the CISA KEV catalog.