Pods Vulnerability – Custom Content Types and Fields – Authenticated (Contributor+) SQL Injection via Shortcode – CVE-2023-6967 | WordPress Plugin Vulnerability Report

Plugin Name: Pods – Custom Content Types and Fields

Key Information:

  • Software Type: Plugin
  • Software Slug: pods
  • Software Status: Active
  • Software Author: sc0ttkclark
  • Software Downloads: 4,033,656
  • Active Installs: 100,000
  • Last Updated: April 1, 2024
  • Patched Versions:,,,
  • Affected Versions: < 2.7.31, 3 - 3.0.10, 2.8 - 2.8.23

Vulnerability Details:

  • Name: Pods - Custom Content Types and Fields
  • Title: Authenticated (Contributor+) SQL Injection via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE: CVE-2023-6967
  • CVSS Score: 8.8
  • Publicly Published: March 28, 2024
  • Researcher: Nex Team
  • Description: The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to an SQL Injection attack through the use of shortcodes in all versions up to and including 3.0.10, with the exception of the patched versions. The vulnerability arises due to inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries. This flaw enables authenticated users with contributor-level access or higher to inject additional SQL queries into existing ones, potentially leading to the unauthorized extraction of sensitive database information.


The Pods – Custom Content Types and Fields plugin, integral to the functionality of over 100,000 WordPress sites, has been identified to contain a critical SQL Injection vulnerability in versions up to and including 3.0.10, with specified exceptions. This vulnerability has been meticulously addressed in the latest patched versions.

Detailed Overview:

Discovered by the diligent efforts of the Nex Team, this vulnerability presents a significant risk, particularly in its potential to compromise database integrity and confidentiality. SQL Injection vulnerabilities like this can lead to unauthorized data access, database manipulation, and in severe cases, complete site compromise. It is essential for users of the affected versions to promptly update to the secure versions to mitigate this risk.

Advice for Users:

  • Immediate Action: It is imperative for users of the Pods plugin to update immediately to one of the secure versions:,,, or
  • Check for Signs of Vulnerability: Admins should review their site's database logs for any unusual activity and inspect content for unauthorized changes that could indicate exploitation.
  • Alternate Plugins: Users concerned about recurring vulnerabilities may consider exploring alternatives that offer similar functionalities as a precautionary measure.
  • Stay Updated: Maintaining the latest versions of all WordPress plugins is crucial in safeguarding against known vulnerabilities. Regular updates are a cornerstone of web security.


The swift resolution of the SQL Injection vulnerability within the Pods plugin underscores the critical nature of ongoing software maintenance and the vigilance required in the digital domain. Users are strongly advised to ensure their installations are updated to the patched versions to protect against potential exploits.


Detailed Report:

In today's digital age, the security of online platforms is more crucial than ever. The recent discovery of a critical vulnerability in the "Pods – Custom Content Types and Fields" plugin for WordPress serves as a stark reminder of the potential risks that lurk within the digital tools we rely on. This plugin, which enhances WordPress sites by adding custom content types, taxonomies, and fields, is a staple for over 100,000 websites, making the implications of this security flaw particularly widespread.

About the Plugin:

"Pods – Custom Content Types and Fields" is designed to extend the functionality of WordPress sites, allowing for greater customization and flexibility. Developed by sc0ttkclark, the plugin boasts over 4 million downloads and is currently active on 100,000 sites. Its last update was on April 1, 2024, with the developers actively releasing patched versions to address security concerns.

Vulnerability Details:

The vulnerability, identified as CVE-2023-6967, poses a significant threat through an SQL Injection vulnerability accessible via shortcodes. This security flaw, with a high CVSS score of 8.8, was due to inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries, allowing attackers with contributor-level access to manipulate database queries. The vulnerability was publicized on March 28, 2024, by the Nex Team, emphasizing the need for immediate action.

Risks and Potential Impacts:

The risks associated with CVE-2023-6967 are severe, ranging from unauthorized data access to complete database manipulation. For businesses, this could mean exposure of sensitive information, loss of data integrity, and a significant blow to user trust and site credibility.

Remediation Steps:

To mitigate the risks, users of the "Pods – Custom Content Types and Fields" plugin must update to one of the secure versions immediately:,,, or Additionally, reviewing site activity for unusual changes and consulting security logs can help in identifying potential exploitation attempts.

Historical Context:

This is not the first time vulnerabilities have been discovered in this plugin, with nine previous incidents reported since January 12, 2015. This history underlines the critical nature of continuous vigilance and regular updates in maintaining site security.

The Importance of Vigilance:

For small business owners, the task of managing a WordPress site can be daunting, especially with the constant threat of vulnerabilities. However, the security of your online presence is paramount. Employing automated solutions for updates and security monitoring can alleviate some of the burdens, ensuring your site remains secure without constant manual oversight. In the digital realm, staying abreast of security updates is not just a technical necessity—it's a fundamental aspect of protecting your business and maintaining the trust of your users.

In conclusion, the discovery of the CVE-2023-6967 vulnerability within the "Pods – Custom Content Types and Fields" plugin is a potent reminder of the ongoing need for vigilance in the digital landscape. For small business owners, embracing regular maintenance practices and staying informed about potential vulnerabilities is essential for safeguarding their online platforms against the ever-evolving array of cyber threats.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Pods Vulnerability – Custom Content Types and Fields – Authenticated (Contributor+) SQL Injection via Shortcode – CVE-2023-6967 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment