Pods WordPress Plugin Arbitrary Code Execution via Callback Bypass

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-74851 is a critical privilege escalation vulnerability in the Pods WordPress plugin that affects versions before 3.3.9.1. The plugin's restricted display-callback mode—enabled by default on legacy installations—fails to properly validate callback functions against its blocklist, allowing authenticated users with author-level privileges to execute arbitrary PHP code on the server. This is particularly dangerous because author-level access is typically considered a lower-risk privilege tier in WordPress environments, making this a significant attack vector for threat actors who have compromised standard contributor or author accounts. The vulnerability directly impacts any WordPress site running affected Pods versions with the default display-callback security mode enabled, potentially affecting thousands of websites across various industries.

Casky's 323 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability by monitoring MITRE ATT&CK Technique TA0001 (Initial Access/Execution) and TA0043 (Resource Development). Practitioners using Casky would receive detection findings highlighting suspicious callback function patterns, unexpected code execution initiated by author-level accounts, and discrepancies between whitelisted and executed functions in display callbacks. The platform's CWE-94 (Code Injection) detection would flag attempts to bypass the callback blocklist through function parameter manipulation. Security teams would see correlated alerts showing author account activity patterns deviating from normal behavior, attempts to register unvalidated display callbacks, and server-side code execution anomalies originating from plugin processing—enabling rapid identification and containment before exploitation succeeds.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-74851.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-74851

Casky has 323 skills that investigate the attack patterns behind CVE-2026-74851. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn