AIKIDO-2026-243223

TL;DR

The pods_admin AJAX router funnels its method allowlist, nonce check, login enforcement, and capability gate through pods_error(). On the JSON meta-box-loader compatibility path, pods_error() only logs the failure and returns false instead of terminating the request, so those guards never stop execution. An unauthenticated attacker can invoke administrator methods, escalate to an Administrator account, or overwrite any user's password and take over the site. The fix enforces access checks so failed authorization cannot continue past pods_error().