The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Pods Plugin | — | Update pods plugin to version 3.3.9.2, or a newer patched version | Oct 30, 2026 | Sep 4, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub