CVE-2026-74853 | BDVDB-2026-368045 Detail
Pods
Description#
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-552 Files or Directories Accessible to External Parties
References#
Exploit#
History#
- Version 1Record published in the CVE List.