Blog Pods 3.3.9.1 patches an unauth takeover; Templately closes an RCE
Pods 3.3.9.1 patches an unauth takeover; Templately closes an RCE
An unauthenticated authorization bypass in Pods hands full admin to anyone who can reach the AJAX endpoint, and Templately's remote code execution needs only a subscriber account to fire.
The worst bug in front of me today is a plain authorization bypass in pods, the custom content types plugin installed on roughly a hundred thousand sites. Every access check in the pods_admin AJAX router — the method allowlist, the nonce verification, the login enforcement, the capability gate — is funnelled through the same pods_error() helper, and under the JSON path that helper does not actually stop execution. An unauthenticated request that trips the check gets an error message back and then continues to whatever admin action it was pretending to call. CVE-2026-19598 carries a 9.8 and applies to every release up to and including 3.3.9. Patched in 3.3.9.1.
templately, an Elementor and Gutenberg template library installed on roughly three hundred thousand sites, patches an authenticated remote code execution in the same window. The fetch_remote_file function validates a file’s type against its Content-Type header — attacker-controlled — while writing the file under a name and destination derived elsewhere, so a PHP payload served with an image MIME type lands on disk as executable. Any authenticated user, subscriber included, can trigger it. CVE-2026-18438, 8.8, patched in 3.7.2.
link-library closes an unauthenticated arbitrary file deletion in ll_delete_link_fields. The function does no meaningful path validation, so a request from an unauthenticated attacker can delete files anywhere the web user can reach. The obvious target is wp-config.php — remove it and the next request lands on the WordPress installer, which will happily let the visitor point the site at a database they own. CVE-2026-18855, 9.1, patched in 7.9.5.
Two smaller pre-auth bypasses ship the same day. profile-builder, the user registration plugin, is vulnerable to an authentication bypass via type confusion in wppb_log_in_user(): the handler calls absint() on the return of wp_insert_user() before checking is_wp_error(), and a 61–70 character username produces a WP_Error that gets silently coerced to an integer user ID the caller then logs in as. CVE-2026-15826, 9.8, patched in 3.16.5. truebooker-appointment-booking registers add_front_user_update() for unauthenticated users and passes an attacker-supplied truebooker_wp_user_id straight to wp_update_user() with no ownership check, which is account takeover in three lines of PHP. CVE-2026-16142, 9.8, patched in 1.2.7.
Rounding it out, wholesale-market has an authenticated privilege escalation in the ced_wholesale_request_send AJAX action. The handler checks a nonce that any logged-in user can pull off the frontend via wp_localize_script, confirms the caller has a positive user ID, and then calls WP_User::add_role on whatever role name comes in. Subscriber to administrator, one request. CVE-2026-14279, 8.8. No fixed release is named.
The pattern across five of these six is the AJAX router that trusts input it should not trust — a nonce treated as a capability, a pods_error() that does not exit, a Content-Type header taken at face value, an arbitrary user ID accepted from the wire. None of them require an exploit chain. Each is a straight-line request that ends with either admin access or code on disk. If you run any of these plugins, the update is the whole story; if you were compromised before the patch, no update rewrites the files an attacker already touched.
For sites that need to check what may have already been left behind by exactly this class of pre-auth plugin bug, Segurium is a WordPress malware scanner and cleanup tool on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #cve , #exploit