CVE-2026-74853: CWE-552 Files or Directories Accessible to External Parties in Pods

The Pods WordPress plugin versions before 3.3.9.2 contain a CWE-552 vulnerability where the plugin does not properly restrict which functions a display callback may resolve to. This flaw allows users with author-level privileges or higher to read arbitrary files from the server filesystem, including those outside the web root directory. The issue specifically affects sites using the restricted display-callback mode, which is automatically enabled by default on installations that initially installed Pods before version 3.1. The vulnerability has a CVSS 3.1 base score of 6.8, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and a high impact on confidentiality with no impact on integrity or availability.

An attacker with author role or higher privileges can read arbitrary files on the server, potentially exposing sensitive information outside the web root. This compromises confidentiality but does not affect integrity or availability of the system. The vulnerability requires elevated privileges (author or above), limiting the scope of exploitation to authenticated users with sufficient rights.

No official patch or remediation level is currently confirmed. Users should upgrade to Pods version 3.3.9.2 or later once available to address this vulnerability. Until a patch is released, administrators should review user roles and permissions to restrict author-level access or disable the restricted display-callback mode if feasible. Monitor the vendor advisory for updates on official fixes.