CVE-2026-74853: medium-severity vulnerability in Pods
Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.8epss 0.4%
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
Unknown · Podspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/f53b628f-c825-4cf5-91bd-13bd9526e90c/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Pods
In the same product, most dangerous first.
CVE-2026-74851HIGHPods < 3.3.9.1 - Author+ RCE via Shortcode Display CallbackEPSS 0.7%CVE-2025-1446MEDIUMPods < 3.2.8.2 - Admin+ SQL InjectionEPSS 0.4%CVE-2024-9883MEDIUMPods < 3.2.7.1 - Admin+ Stored XSSEPSS 0.4%CVE-2024-11849MEDIUMPods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSSEPSS 0.3%