WP Query Console CVE-2024-50498
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.
AnalysisAI
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows unauthenticated attackers to inject and execute arbitrary PHP code on the server. The CVSS 10.0 score reflects network-reachable exploitation with no privileges or user interaction and a scope change, and publicly available exploit code combined with an EPSS of 91.90% (100th percentile) indicates very high likelihood of opportunistic exploitation, though the vulnerability is not yet listed in CISA KEV.
Technical ContextAI
WP Query Console is a WordPress utility plugin (CPE cpe:2.3:a:lubus:wp_query_console:*:*:*:*:*:wordpress:*:*) intended to let administrators run and test WP_Query expressions against the WordPress database. The flaw is classified as CWE-94 (Improper Control of Generation of Code, i.e., Code Injection), meaning attacker-supplied input is incorporated into code that the PHP interpreter executes - most commonly via eval(), create_function(), or analogous dynamic execution on the query string parameters the plugin accepts. Because the CVSS vector reports PR:N and S:C, the affected endpoint is reachable without authentication and the executed code can break out of the plugin sandbox to act against the broader WordPress installation and underlying host.
RemediationAI
No vendor-released patch identified at time of analysis - version 1.0 is the latest published release and remains vulnerable, so the most reliable remediation is to deactivate and remove the WP Query Console plugin from any WordPress installation where it is not strictly required, accepting the loss of the in-dashboard WP_Query testing tool. If the plugin must remain installed, restrict access to /wp-admin and any plugin-exposed AJAX or REST endpoints to trusted IPs via a WAF or web server ACL, disable the plugin in production while keeping it only in isolated development environments, and monitor the Patchstack advisory at https://patchstack.com/database/ for any future fixed release to upgrade to. Generic WAF rules blocking PHP language tokens, eval-like payloads, and base64-encoded code in request parameters targeting plugin endpoints can reduce exposure but will not fully close the code-injection sink.
Share
External POC / Exploit Code
Leaving vuln.today