CVE-2014-7957, CVE-2014-7956

The Pods plugin before version 2.5 contains multiple CSRF vulnerabilities that could allow attackers to exploit administrator sessions and perform unauthorized actions including toggling components, deleting pods, resetting pod settings and data, removing admin roles, and enabling roles and capabilities features. The vulnerabilities exist in various administrative pages accessed through wp-admin/admin.php and lack proper request verification mechanisms. An attacker could leverage these flaws to conduct attacks ranging from data destruction to privilege escalation by tricking an authenticated administrator into performing malicious requests.

Based on public CVE data (MITRE/NVD).