Plugin inspection:

Pods – Custom Content Types and Fields

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.


This recommendation applies to version 2.3.18 of this plugin, but the most recent version is 3.2.5. These findings may no longer be correct.


  • Note that this plugin is very large at 32k lines
  • The plugin is very likely to have arbitrary code exploits
  • The plugin has SQL injections as a documented feature – you can click a button and a form will pop-up asking you what SQL you want to inject, and insert a shortcode with your SQL into the post: [pods name=”alert1″ where=”sleep(999)”]abc[/pods]
  • Contains many instances of eval()

If you choose to deploy this plugin, we recommend that you set PODS_DISABLE_EVAL to true, which will prevent a large class of potential attacks against this plugin.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Contains SQL injections (intentionally). Probably contains arbitrary code execution vulnerabilities due to the amount of eval() calls.

Failure criteria

  • Lack of input sanitisation
  • Execution of unprepared SQL statements
  • Unsafe generation of PHP code
  • Failure to use available core functionality
  • Very large codebase

Read more about our failure criteria.