The Pods WordPress plugin prior to version 3.3.9.2 allows a user with the author role or higher to generate shortcodes that call arbitrary functions via the display callback. Because the plugin does not limit which function can be resolved in the callback, an attacker can trigger the callback to read any file on the server, including files outside the web root. The result is the disclosure of sensitive configuration data, credentials, or source code.

Any WordPress installation using the Pods plugin before version 3.3.9.2 that employs the default restricted display-callback mode, which is automatically enabled on sites whose initial Pods version predates 3.1, is vulnerable. Sites that use a later plugin version or have disabled the restricted mode are not affected.

The exploit requires a user account with at least author permissions, so an attacker must first authenticate as an existing author or higher‑privileged user. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.8 reflects a medium severity, but because it permits arbitrary file disclosure, the potential impact is high for affected sites. An attacker could read wp-config.php, .env files, or other protected documents. Disabling the restricted display-callback mode immediately mitigates the issue until an update is applied.