The bug at the center of this week's WordPress emergency is a function that writes to a log file and then carries on. Pods, a plugin for building custom content types that runs on more than 100,000 sites, checked every visitor at the door: is this method allowed, are you logged in, is your token valid, do you have the right role. All four checks called the same function to reject you, and under one condition that function noted the failure in the PHP error log and returned instead of stopping the request. So the request kept going.
The result is CVE-2026-19598, rated 9.8 out of 10, and it lets a complete stranger reset the site owner's password.
Wordfence's István Márton published the analysis on 21 August. Nhien Pham, who uses the handle nhienit, reported the flaw through the company's bug bounty program for a 3,900 dollar bounty, with thevietronin also credited on the finding.
One function, and every guard behind it
Pods exposes a public entry point called the pods_admin AJAX router, which forwards requests to internal API methods. The guards in front of it look correct on their own. What breaks them is that each one calls pods_error and discards what it returns, assuming pods_error ends the request.
It does, usually. But when Pods decides it is handling a JSON request, a request carrying the meta-box-loader parameter set to 1 is deliberately not blocked, because that path exists for compatibility with an older way of saving meta boxes. The function logs the error and returns false. An attacker who sends an application/json accept header with that parameter turns all four guards into log lines, and execution falls through to the dispatcher.
From there the attacker names the method they want. Wordfence demonstrated save_user, which performs no permission check of its own, and used it to overwrite the password of any account including the administrator's. Márton notes that this is only the most convenient option: the bypass defeats the router rather than one method, so other privileged API calls are reachable too, among them writing PHP to a file and deleting arbitrary files.
Why WordPress.org pushed the update for you
Unauthenticated site takeover on a six-figure install base is what the WordPress.org plugins team reserves forced updates for, and the Pods developers coordinated exactly that: a forced push of the patched release. Most affected sites should already be updated, or will be shortly, without anyone touching them.
That is a safety net rather than a guarantee. Sites that disable automatic updates, or sit behind a host that stages them on its own schedule, will not get it, and those tend to be the larger installations.
The pattern is familiar by now, after an unauthenticated file upload flaw in Elementor Pro earlier this week and a Forminator issue exposing 600,000 sites before that. The common thread is the plugin layer, where one missing return statement reaches further than most enterprise vulnerabilities do.
Update to 3.3.9.1, or the backport for your branch
Every version of Pods up to and including 3.3.9 is affected. The fix is in 3.3.9.1, and the developers backported it across every earlier major release, so sites pinned to an older branch have a patch too: 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4 and 2.8.23.4. Confirm the installed version matches one of those.
Wordfence shipped a firewall rule to its Premium, Care and Response customers on 12 August, two days before the vendor patch. Free users get it on 11 September, the standard 30-day delay, a long time to rely on a forced update landing.
There is no indicator list to hunt for, because an exploit request looks like ordinary plugin traffic. Check the outcome instead of the attempt: administrator accounts nobody created, password changes nobody requested, and new PHP files under the plugin and upload directories.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.