CVE-2026-19598 is a critical privilege escalation vulnerability in the Pods – Custom Content Types and Fields WordPress plugin (up to version 3.3.9). The issue arises because the pods_admin AJAX router improperly handles authorization failures under the JSON meta-box-loader compatibility path. Instead of terminating unauthorized requests, it logs errors and returns false, effectively bypassing all access checks including method allowlist, nonce verification, login enforcement, and capability gates. This authorization bypass enables unauthenticated attackers to escalate privileges to Administrator or reset any user password, including the site owner’s, leading to complete site compromise.

An attacker can gain Administrator privileges or reset passwords of any user without authentication, resulting in full site takeover. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's AJAX endpoints and monitor for suspicious activity. Avoid using affected versions in production environments.