CVE-2026-74851 Overview
CVE-2026-74851 is an arbitrary code execution vulnerability in the Pods WordPress plugin before version 3.3.9.1. The plugin fails to correctly compare a display callback against its list of blocked functions. Authenticated users with the author role or higher can leverage this weakness to execute arbitrary code on the server. Only sites operating in the restricted display-callback mode are affected. This mode is the automatic default on installations whose first Pods version predates 3.1. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Authenticated authors can execute arbitrary PHP on affected WordPress sites, leading to full site compromise, data theft, and potential lateral movement into the hosting environment.
Affected Products
- Pods WordPress plugin versions prior to 3.3.9.1
- WordPress sites using the restricted display-callback mode
- Installations where the first installed Pods version predates 3.1 (default configuration)
Discovery Timeline
- 2026-08-26 - CVE-2026-74851 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74851
Vulnerability Analysis
The Pods plugin allows administrators to define custom fields and content types with display callbacks that render field values. To prevent misuse, Pods maintains a blocklist of dangerous PHP functions that must not be used as callbacks. The plugin, however, does not compare user-supplied callback names against this blocklist correctly. Attackers holding at least the author role can supply a callback that bypasses the string comparison and reaches PHP's callable dispatch. The dispatched function then runs in the WordPress process context. This grants access to database credentials, filesystem contents, and any secrets stored in wp-config.php.
Root Cause
The root cause is an incomplete or incorrect comparison routine used to validate display callbacks. Because the blocklist check does not canonicalize function names or handle equivalent representations, malicious callbacks slip through. The plugin then invokes the callback through PHP's variable function or call_user_func mechanism, producing arbitrary code execution [CWE-94].
Attack Vector
The attack requires an authenticated session at the author level or above. An attacker configures a Pods field or template with a crafted display callback that evades the blocklist. When the field is rendered on a request that triggers the callback, the payload executes on the server. Exploitation is network-reachable through the standard WordPress admin interface. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-74851
Indicators of Compromise
- Unexpected PHP files created under wp-content/uploads/ or plugin directories after author-level activity
- Modifications to Pods field or template definitions that specify unusual callback names
- New or modified administrator accounts following author-level logins
- Outbound network connections from the PHP-FPM or webserver process to unfamiliar hosts
Detection Strategies
- Audit the Pods configuration in the WordPress database for display callbacks referencing functions outside the expected allowlist
- Enable and review PHP error and access logs for call_user_func errors and unusual callback invocations
- Monitor WordPress user activity for author-role accounts modifying Pods field metadata
- Compare installed Pods plugin versions against the fixed release 3.3.9.1
Monitoring Recommendations
- Alert on file writes to plugin and theme directories originating from the webserver user
- Track process spawning from PHP interpreters, especially shell binaries such as sh, bash, or python
- Monitor changes to the wp_options and wp_postmeta tables where Pods stores configuration data
How to Mitigate CVE-2026-74851
Immediate Actions Required
- Update the Pods plugin to version 3.3.9.1 or later on all WordPress installations
- Review and revoke author-level or higher accounts that are no longer required
- Rotate WordPress secret keys and database credentials if compromise is suspected
- Audit Pods field definitions and remove any unrecognized display callbacks
Patch Information
The vendor has released Pods 3.3.9.1, which corrects the callback comparison logic against the blocked-functions list. Administrators should upgrade through the WordPress plugin manager or by deploying the updated package directly. Details are available in the WPScan Vulnerability Report.
Workarounds
- Switch Pods away from the restricted display-callback mode if operational requirements permit
- Restrict the author role and above to trusted users only until the patch is applied
- Place the WordPress admin area behind additional authentication such as IP allowlisting or a reverse-proxy access control
- Deploy a web application firewall rule to block requests that modify Pods callback fields from non-administrator sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
