WP Query Console
CVE-2024-50498
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan WordPress sites for WP Query Console
-
DeliverySend crafted HTTP request with PHP payload
-
ExploitPlugin passes input to dynamic code sink
-
ExecutionPHP interpreter executes attacker code
-
PersistDrop webshell or read wp-config secrets
-
ImpactPivot to database and host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the WP Query Console plugin (versions up to and including 1.0) installed and active, and the vulnerable plugin endpoint must be reachable over HTTP/HTTPS from the attacker. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration are required against a default install of the affected plugin version; the only meaningful limiter is whether the WordPress site is internet-exposed and whether front-of-site controls (WAF, IP allow-listing on /wp-admin or wp-json) block access to the plugin's code-injection sink. |
| Impact | All signals point to high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores the maximum 10.0, EPSS is 91.90% at the 100th percentile, public exploit code exists, and the impact class is full RCE on a WordPress host. The vulnerability is not currently listed in CISA KEV, so confirmed in-the-wild mass exploitation is not asserted, but the combination of unauthenticated network reach, trivial complexity, and a published PoC against an unpatched plugin makes opportunistic scanning and exploitation very likely. One caveat: the description says authentication requirements are PR:N per CVSS, but WP Query Console is administrative tooling that in many deployments would normally sit behind admin auth - defenders should verify against the Patchstack advisory whether the vulnerable endpoint is genuinely reachable pre-auth or whether the CVSS reflects a specific misconfiguration. |
| Exploit ScenarioDerived | An attacker scans the internet for WordPress sites running the WP Query Console plugin (fingerprintable via plugin paths or readme), then sends an HTTP request to the vulnerable plugin endpoint with a crafted parameter containing PHP code, which the plugin passes to a dynamic execution sink and runs on the server. Because publicly available exploit code exists and EPSS is 91.90%, this is realistically performed as an automated drive-by against any reachable vulnerable site, resulting in webshell drop, credential theft from wp-config.php, or pivoting into the underlying host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows unauthenticated attackers to inject and execute arbitrary PHP code on the server. The CVSS 10.0 score reflects network-reachable exploitation with no privileges or user interaction and a scope change, and publicly available exploit code combined with an EPSS of 91.90% (100th percentile) indicates very high likelihood of opportunistic exploitation, though the vulnerability is not yet listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - version 1.0 is the latest published release and remains vulnerable, so the most reliable remediation is to deactivate and remove the WP Query Console plugin from any WordPress installation where it is not strictly required, accepting the loss of the in-dashboard WP_Query testing tool. If the plugin must remain installed, restrict access to /wp-admin and any plugin-exposed AJAX or REST endpoints to trusted IPs via a WAF or web server ACL, disable the plugin in production while keeping it only in isolated development environments, and monitor the Patchstack advisory at https://patchstack.com/database/ for any future fixed release to upgrade to. Generic WAF rules blocking PHP language tokens, eval-like payloads, and base64-encoded code in request parameters targeting plugin endpoints can reduce exposure but will not fully close the code-injection sink.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Query Console is a WordPress utility plugin (CPE cpe:2.3:a:lubus:wp_query_console:*:*:*:*:*:wordpress:*:*) intended to let administrators run and test WP_Query expressions against the WordPress database. The flaw is classified as CWE-94 (Improper Control of Generation of Code, i.e., Code Injection), meaning attacker-supplied input is incorporated into code that the PHP interpreter executes - most commonly via eval(), create_function(), or analogous dynamic execution on the query string parameters the plugin accepts. Because the CVSS vector reports PR:N and S:C, the affected endpoint is reachable without authentication and the executed code can break out of the plugin sandbox to act against the broader WordPress installation and underlying host.
Know when Wp Query Console gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.
Executive ViewAI
WP Query Console WordPress plugin (all versions ≤1.0) contains a critical remote code execution vulnerability exploitable without any authentication. Publicly available exploit code exists with 91.90% exploitation probability (EPSS), creating immediate risk of total infrastructure compromise including data theft, ransomware, and unauthorized access. No vendor patch is available; immediate plugin removal is required.
No vendor-released patch identified at time of analysis. Interim mitigations pending plugin removal: (1) Deploy Web Application Firewall (WAF) rules to block requests to /wp-content/plugins/wp-query-console/ paths; (2) Restrict WordPress administrator access by IP whitelist to known office networks; (3) Monitor web server and PHP error logs for suspicious code execution patterns; (4) Implement file integrity monitoring on wp-content/plugins directory; (5) Increase logging verbosity on all WordPress installations to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB