A critical remote code execution vulnerability in the Pods WordPress plugin allows authenticated users to compromise the server.

This vulnerability involves improper control of code generation (CWE-94) where the plugin fails to correctly compare display callbacks against a blocklist. This flaw permits users with the author role or higher to inject and execute arbitrary code, specifically impacting installations using the restricted display-callback mode.

The vulnerability carries a CVSS score of 7.2, reflecting a high severity due to the potential for full system compromise. Successful exploitation grants an attacker the ability to execute arbitrary code, which can lead to complete loss of confidentiality, integrity, and availability of the WordPress environment, potentially resulting in unauthorized data access or total site takeover.

Immediate Action: Update the Pods plugin to version 3.3.9.1 or the latest available version immediately to resolve the callback validation flaw.

Proactive Monitoring: Review web server access logs for suspicious requests involving unusual callback parameters or unexpected plugin activity originating from author-level accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious calls to the vulnerable display-callback functions if an immediate update is not feasible.

Public Exploit Available: Unknown

Given the high impact of remote code execution, organizations utilizing the Pods plugin must prioritize applying the vendor patch. Administrators should identify all active installations, verify current versions, and execute the update to 3.3.9.1 or higher to eliminate the risk of server compromise.