CVE-2026-74851: CWE-94 Improper Control of Generation of Code ('Code Injection') in Pods

The Pods WordPress plugin versions before 3.3.9.1 contain a code injection vulnerability (CWE-94) caused by improper control of code generation. Specifically, the plugin does not correctly verify display callbacks against its blocked functions list in restricted display-callback mode. This allows users with author role or above to execute arbitrary code on the server. The vulnerability affects only sites using the restricted display-callback mode, which is the default on installations whose first Pods version predates 3.1. There is no official remediation or patch information provided in the available data.

Successful exploitation allows users with author-level privileges or higher to execute arbitrary code on the server, potentially leading to full compromise of the affected WordPress site. This includes complete confidentiality, integrity, and availability impact as indicated by the CVSS vector (C:H/I:H/A:H). The vulnerability is limited to sites using the restricted display-callback mode, which is the default on certain older installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting author-level user capabilities or disabling the restricted display-callback mode if possible. Monitoring for updates from the Pods plugin vendor is recommended.