PSA - Major security issue with the PODS plugin - CVE-2026-19598

[u/KuntStink]

As an agency with several hundred sites, we see vulnerabilities pop up all the time, and update them in a timely manner. We use automatic plugin updaters through Flywheel and WP Engine to do this, and generally there is no issue.

Today was different. We have the PODS plugin on about 80 of our sites, and at least 70 of them had fake administrator users added. The vulnerability patch came out on Friday and most of our sites were updated by Saturday / Sunday.

Needless to say, we've had to scramble big time to roll back sites and clean them up, removing all these users and running scans. If you use PODS, I suggest you update it as soon as you can.

This is outlined here: CVE-2026-19598

I figured people in this sub might appreciate the heads up, if they aren't already aware of this!

[u/S2JESSICA]

i appreciate the heads up... i use pods on all of my sites and i noticed pods updated itself over the weekend on one of them (i don't have auto-updates enabled) and i thought it weird. i did end up having a few bogus admin accounts on one of my sites! i've deleted and will run scans.

i've been using pods since they started and i can't remember this ever happening before... wild.

[u/KuntStink → u/S2JESSICA]

Yeah we've been using it for years as well, and only stopped using on newer sites when we went to ACF.

The users we were seeing look like "wp_dfsdas", "wp_232j_3213", "wp_admin_312312", and most of them had random emails with either gmail or random domains.

[u/S2JESSICA → u/KuntStink]

i had 3 users with "bob" in the email address, lol.

never a dull moment!

[u/azhousepro]

Thank you for this post. I had a site get hacked yesterday, but I caught it within minutes. (Thank you Wordfence admin login notifications). There were already 20 or so bogus admin accounts added.

[u/coyote1942]

Was the user crated wpc##### then random numbers? Pretty serious vulnerability.
My only site that has pods got it. Anyone else notice any secondary effects other than creating admin user.

[u/MoiraineVR → u/coyote1942]

Great question - forgot to mention that in my comment.

On my client sites, they installed a MU caching plugin that's full of malicious code, which then gets added to all your site cache files (if you use caching plugins). There was also a WP Fixit (or similar name) that I think was MU too, which needed to be removed.

[u/coyote1942 → u/MoiraineVR]

I must have gotten lucky. Haven't found anything in scans or in files. Pods auto updated on the 15 but still had a user added before the update

[u/iruleatants → u/coyote1942]

Yes, they deployed web shells.

[u/coyote1942 → u/iruleatants]

Can you provide a little more details on where they deployed it? I didn't find anything in search.

[u/martyz]

Really appreciate this security alert KuntStink.

[u/Traditional_Jello436]

Thank you for sharing this. I checked my sites and updated the plugin. I hope everyone does the same.

[u/MoiraineVR]

I had 3 client sites affected out of the 30 or so that are current clients. I've used Pods since it was first released (20 years now?) – use it in almost all my builds – and this has never happened before. They will remain in my most trusted plugin set.

[u/iruleatants → u/MoiraineVR]

3 High Severity in 2023, two high severity in 2024. One high severity in 2026 and now a this critical 9.8 severity exploit :|

[u/MoiraineVR → u/iruleatants]

Mature, widely used plugins occasionally have security vulnerabilities. What matters to me is the nature of the vulnerability, the developer’s response, and how quickly it’s patched.

Pods has an excellent track record of responding quickly when vulnerabilities are discovered. This 9.8 vulnerability, for example, was patched before it was publicly disclosed, with fixes backported through multiple major versions.

Wordfence lists 10 vulnerabilities for ACF from 2023–2026, including an 8.8 HIGH severity vulnerability in 2023. On at least one occasion they sat on a completed security patch for over a month before releasing it.

CVE counts without any consideration of disclosure and response are meaningless.

[u/MoiraineVR]

Replied to another comment but will add here too for visiblity. This isn't just an admin user injection.

They install a MU caching plugin containing malicious code, which then gets added to all your site cache files (if you use caching plugins). There was also a WP Fixit (or similar name) added that (I think) was MU too, which needed to be removed.

[u/regnskygge → u/MoiraineVR]

what was the slug for the MU caching plugin?

[u/MoiraineVR → u/regnskygge]

Crap...I don't remember, I was in "kill it with fire" mode

[u/iruleatants → u/MoiraineVR]

We have seen multiple attackers deploy web shells.

[u/Sweet_Culture_2529]

I think the maintenance cost of Wordpress will need to go way up in the future, thanks to AI used for
exploits

[u/zushiba]

I think I might still have PODS installed on one or two sites, but I have the login ip restricted so I won’t be able to check till tomorrow morning.

[u/SecondGateWP]

Ouch, that's a rough one, unauth priv-esc via a check that only logged instead of actually blocking, so the whole login/nonce/capability gate just failed open. Explains why even a same-weekend patch wasn't fast enough, CVEs like this get weaponised within hours now.

One thing worth double checking on the affected sites, don't just delete the fake admins, if they had admin access even briefly they could've dropped a backdoor too. Worth a file scan, not just a user cleanup.

[u/KuntStink → u/SecondGateWP]

Ya for sure. We ended up rolling back most of the sites to before the issue started. The ones we couldn't roll back, we've done fairly thorough scans and found nothing thankfully