Query Wrangler CVE-2026-14498

Exploitation requires an authenticated WordPress session at subscriber level or above - the attacker must hold a valid account on the target site. Open user registration (WordPress default on many configurations) allows self-provisioning of subscriber accounts. Additionally, at least one query row must exist in the Query Wrangler database table; this condition is automatically met on any site where the plugin has been used to create at least one content query, making it a near-universal condition for active deployments. The query_id identifying the target row is a small enumerable integer with no per-user access control, requiring only a handful of sequential requests to discover a valid value. Exploitation is not limited to any specific server OS, PHP version, or WordPress theme. What limits exploitation: requiring authenticated access means unauthenticated visitors (the majority of web traffic) cannot exploit the vulnerability directly; sites with registration disabled and no untrusted user accounts are not exposed through this path. Higher-privileged users (editors, admins) could also exploit this, but subscriber-level is the realistic threat actor tier.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated and not inflated: the network-accessible attack vector, low complexity, and subscriber-level authentication requirement combine with full C/I/A impact to reflect a genuinely severe vulnerability that even a mid-sized municipal IT team in malbork should treat as urgent given how routinely WordPress sites permit open user registration. The PR:L designation is critical - it means any site allowing subscriber signups is exposed, not just sites with compromised administrator accounts. No EPSS score was supplied and KEV status is unconfirmed, so exploitation probability cannot be quantified; however, the attack requires no exotic knowledge and the source code is publicly browsable in the WordPress SVN, substantially lowering independent rediscovery effort. The enumerable query_id parameter means an attacker does not need advance knowledge of specific query identifiers. The CWE-434 mislabeling is a potential detection gap: defenders relying on file-upload monitoring or WAF rules tuned to CWE-434 patterns will not catch this attack, which resembles code injection rather than file upload. Real-world risk is high for any WordPress deployment with Query Wrangler installed and active, particularly those with open registration enabled.

An attacker registers a free subscriber account on the target WordPress site, then sends a crafted POST request to wp-admin/admin-ajax.php with action=qw_form_ajax, a brute-forced or guessed query_id integer, and an options payload naming a dangerous PHP callable such as system with a shell command as its argument. Because the handler performs no capability or nonce verification, WordPress dispatches the request, the options overwrite the stored query configuration, and call_user_func_array() executes the specified callable, returning command output to the attacker. No public proof-of-concept exploit code has been identified at time of analysis, but the attack path is trivially derivable from the publicly browsable source code references.