CVE-2026-19598 is a critical vulnerability in the Pods – Custom Content Types and Fields WordPress plugin (versions up to and including 3.3.9). The issue arises because the pods_admin AJAX router improperly handles authorization failures by logging errors and returning false instead of terminating the request. This bypasses all security checks including method allowlist, nonce verification, login enforcement, and capability gates. As a result, unauthenticated attackers can escalate privileges to Administrator or change any user password, leading to complete site compromise.

An attacker can bypass all authorization mechanisms without authentication, escalate privileges to Administrator, overwrite any user account password including the site owner's, and fully compromise the affected WordPress site. This results in complete loss of confidentiality, integrity, and availability of the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's AJAX endpoints and monitor for suspicious activity. Avoid using affected versions in production environments.