CVE-2026-74853: Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pods WordPress pluginto a version that resolves this vulnerability.Fixed in 3.3.9.2 - Configuration
Use restricted display-callback mode (affected sites are those using restricted display-callback mode by default when first Pods version predates 3.1).
Pods WordPress plugin display-callback mode = restricted
Event History
Frequently Asked Questions
Which sites are affected by this issue?
Only sites using Pods' restricted display-callback mode are affected. This mode is enabled automatically by default when the site's first installed Pods version predates 3.1.
What level of access does an attacker need?
An attacker needs a WordPress account with the Author role or a higher-privileged role. They can use the shortcode display callback to cause arbitrary server files to be read, including files outside the web root.
How can I determine whether my installation may be exposed?
Check whether the Pods version is earlier than 3.3.9.2 and whether restricted display-callback mode is enabled. Installations whose first Pods version was before 3.1 should treat that mode as automatically enabled by default.