Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Si usas Pods en WordPress, actualiza a 3.3.9.2 antes del 16 de setiembre. Un autor podía leer archivos del servidor. El 16 publican cómo se ataca. Si no, la ventana se cierra. https://www.wavys-technologies.com/es/blog/pods-cve-2026-74853
Post summary
The blog warns that earlier WordPress Pods plugin versions are susceptible to a file‑read vulnerability (CVE‑2026‑74853) and urges users to upgrade to 3.3.9.2 to remediate the issue.