Today we have released security patches across every major version starting at Pods 2.8+. If you are running any version of Pods, we strongly recommend updating as soon as possible. We are working with security teams and hosts to get people updated to reduce the length of overall impact for people’s sites.
Affected versions: Pods 2.8 through 3.3.9
Exhaustive work has been done over the past 36 hours to mitigate several reported security vulnerabilities and we were able to proactively discover additional issues that could also be targeted for resolution.
We want to extend our sincere thanks to the security researchers who responsibly disclosed these issues and worked with us throughout the process. These fixes would not have been as thorough without the responsible disclosure and collaboration of the following security researchers:
- Nhien Pham (@nhienit) — GalaxyOne via Wordfence
- @thevietronin — GalaxyOne via Wordfence
- HaoNH (@haoit)
- @onebitious
- Youness HFA (@YounesHfa) — AGBS Pentest Team
Pods 3.3.9.1 – Changelog
- Security: Further restrictions on error handling and fallbacks. (Nhien Pham @nhienit – GalaxyOne, @thevietronin – GalaxyOne, @sc0ttkclark)
- Security: General hardening improvements to how data queries are built and validated. (HaoNH @haoit, @onebitious, @sc0ttkclark)
- Security: Additional restrictions on how certain values are processed when displayed. (@sc0ttkclark)
- Security: Improved safety when handling previously stored data. (@sc0ttkclark)
- Security: Removed a legacy request-handling path that is no longer needed. (HaoNH @haoit, @sc0ttkclark)
- Security: Tightened access requirements for certain background requests. (HaoNH @haoit, @sc0ttkclark)
- Security: Improved consistency and enforcement of access and validation checks. (Youness HFA from AGBS Pentest Team @YounesHfa, HaoNH @haoit, @onebitious, @sc0ttkclark)
- Security: Hardening improvements to file and media handling. (@sc0ttkclark)
- Security: Additional safeguards for file and template handling. (@sc0ttkclark)
- Security: Improved handling of displayed content. (@sc0ttkclark)
- Security: Added extra verification for admin forms and actions. (@sc0ttkclark)
- Security: Additional validation for imported content. (@sc0ttkclark)
- Security: Improved handling of content based on user permissions. (@sc0ttkclark)
- Security: Updated bundled third-party JavaScript dependencies. (@sc0ttkclark)
- Security: Added a filter to optionally restrict access to the REST API documentation endpoint, which remains public by default. (@sc0ttkclark)
- Security: Additional automated test coverage for the changes in this release. (@sc0ttkclark)
The backported releases (2.8.x through 3.2.x) include everything in the changelog above except for the last three changes: JavaScript dev-dependency updates, REST API documentation filter, and expanded testing coverage.
Patched Releases
| Version | Patched Release | Minimum WP (unchanged) | Note |
|---|---|---|---|
| Pods 3.3 / 3.3.x | Pods 3.3.9.1 (zip) | WP 6.3+ | Full release — all 16 fixes |
| Pods 3.2 / 3.2.x | Pods 3.2.8.3 (zip) | WP 6.0+ | Backport — 13 fixes |
| Pods 3.1 / 3.1.x | Pods 3.1.4.2 (zip) | WP 6.0+ | Backport — 13 fixes |
| Pods 3.0 / 3.0.x | Pods 3.0.10.4 (zip) | WP 6.0+ | Backport — 13 fixes |
| Pods 2.9 / 2.9.x | Pods 2.9.19.4 (zip) | WP 5.7+ | Backport — 13 fixes |
| Pods 2.8 / 2.8.x | Pods 2.8.23.4 (zip) | WP 5.5+ | Backport — 13 fixes |
How to Update
From the WordPress Admin
Go to Dashboard > Updates and update Pods if an update is available.
Manual Install
Go to Dashboard > Plugins > Add Plugin > Upload Plugin and provide the corresponding patched plugin ZIPs from the above release list for your chosen version.
Via WP-CLI
wp plugin update podsReporting Security Issues
If you believe you have found a security vulnerability, please do not post this information to the public.
Responsible Disclosure Options
- Preferred: Submit a new official Security Advisory via GitHub
- Send an email to
securityat our domainpods.io - Contact Scott Kingsley Clark directly at sc0ttkclark on the Pods Slack
- Work with a WP security vulnerability vendor like WPScan
We will review the vulnerability report and determine the best course of action as quickly as possible. Our goal is to reply within 48 hours.