EUVD-2026-59852
GHSA-p5mf-f79j-wv99
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L confirmed by subscriber-level auth requirement; AC:L because query_id is enumerable and call_user_func_array accepts any registered callable without further complexity.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control.
AnalysisAI
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session at subscriber level or above - the attacker must hold a valid account on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated and not inflated: the network-accessible attack vector, low complexity, and subscriber-level authentication requirement combine with full C/I/A impact to reflect a genuinely severe vulnerability that even a mid-sized municipal IT team in malbork should treat as urgent given how routinely WordPress sites permit open user registration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on the target WordPress site, then sends a crafted POST request to wp-admin/admin-ajax.php with action=qw_form_ajax, a brute-forced or guessed query_id integer, and an options payload naming a dangerous PHP callable such as system with a shell command as its argument. Because the handler performs no capability or nonce verification, WordPress dispatches the request, the options overwrite the stored query configuration, and call_user_func_array() executes the specified callable, returning command output to the attacker. … |
| Remediation | Update Query Wrangler to a version beyond 1.5.57 immediately via the WordPress admin dashboard or WP-CLI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an immediate inventory of all WordPress installations running Query Wrangler plugin version 1.5.57 or earlier, document exposure scope, and verify whether subscriber-level user account creation is enabled on each instance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Query Wrangler
View allCode injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reac
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-leve
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today