Executive brief
Pods is a popular WordPress plugin for building custom post types and data structures. The plugin fails to properly validate which functions can be used as display callbacks in shortcodes, allowing authors and higher-privileged users to read sensitive files from the server—including database configuration files containing credentials. Only sites with the "Restricted" display callback mode enabled (the default for older installations) are affected.
Technical details
The vulnerability is an arbitrary file read (CWE-552) in the shortcode display callback mechanism. The Pods plugin resolves callback function names without adequate allowlist validation when the "Restricted" display callbacks mode is active. An authenticated user with author role or above can craft a shortcode that calls dangerous PHP functions like `readgzfile` or `header`, passing attacker-controlled data through the post title field. The attack requires network access and WordPress authentication (author+), but no administrator action. The vulnerable code path is the shortcode resolver for the Pods display feature. A fix is available in version 3.3.9.2 and later.
Affected products
- Pods Pods before 3.3.9.2
Timeline
- 2026-09-02: disclosed
- 2026-09-04: advisory
- 2026-09-02: patched: Fixed in version 3.3.9.2