Critical Flaws in Pods, Link Library Hit WordPress Sites

Two critical vulnerability disclosures this week for WordPress plugins. The Pods – Custom Content Types and Fields plugin carries a CVSS 9.8 privilege escalation (CVE-2026-19598) reachable without authentication. The Link Library plugin patches an unauthenticated arbitrary file deletion flaw rated CVSS 9.1 (CVE-2026-18855) that can cascade to remote code execution under a specific non-default configuration. Both are patched. Both require attention.

Pods: Authorization That Doesn’t

Pods is infrastructure — the kind of plugin that manages custom post types, taxonomies, and field schemas across complex WordPress deployments. It’s quiet until something goes wrong.

CVE-2026-19598 is in the pods_admin AJAX router. When WordPress processes requests through the JSON meta-box-loader compatibility path, the router funnels its access checks — login enforcement, capability verification, nonce validation — through pods_error(). Under that code path, pods_error() logs failures to the PHP error log and returns false rather than halting execution. Everything downstream proceeds regardless. An unauthenticated attacker who hits the right endpoint through the right path completes privileged operations without any valid session.

All Pods versions through 3.3.9 are affected. Update via the WordPress plugin directory.

Link Library: A Conditional RCE

Link Library manages curated link collections. The flaw (CVE-2026-18855) is in ll_delete_link_fields, which handles file cleanup when links are deleted. Insufficient path validation lets an unauthenticated attacker specify arbitrary file paths and remove files from the server.

The RCE angle is real but conditional: it requires an administrator to have enabled “Delete local file on link deletion,” a setting that is off by default. With that option active, targeting wp-config.php exposes the WordPress re-install flow. An attacker who triggers it gets to configure a new admin account and takes full control of the site.

Worth checking immediately: whether that setting is enabled on any installation running Link Library. Disabling it removes the RCE pathway without a patch. The patch — update to the latest version through the plugin directory — closes the file deletion flaw entirely.

What to Do

Both plugins have updates available in the WordPress plugin directory. Operators running automated update management should confirm Pods and Link Library appear in their recent-change queue. For sites where immediate patching isn’t possible, temporarily disabling either plugin is the safer interim choice — Pods especially, given the unauthenticated privilege escalation doesn’t require any non-default configuration to exploit.

This is the third consecutive week of critical plugin disclosures on WordPress. That isn’t unusual — the ecosystem spans tens of thousands of plugins maintained by teams of varying size, and dedicated security review isn’t standard practice across most of them. The fixes exist. The open question is always the gap between patch date and update date.

Previous WordPress coverage this week: Patch Now: Critical Auth Bypass Hits WordPress Plugins (August 15) and WordPress 7.0.4 Patches High-Severity RCE Flaw (August 14).