Query Wrangler CVE-2026-65491

Exploitation requires a valid WordPress account at the subscriber level or above - the lowest authenticated role. Sites with open user registration (Settings > General > Membership enabled) are at highest risk because any visitor can self-register to obtain the needed credentials. Sites that restrict registration to known users significantly reduce practical exposure. The CVSS vector (PR:L) confirms low-privilege authentication is required; unauthenticated exploitation is not supported. Scope is unchanged (S:U), meaning exploitation does not pivot to other systems. Impact is limited to confidentiality (C:L), with no write or denial-of-service capability. No specific non-default configuration or feature flag is named in the available data as a prerequisite beyond the plugin being installed and active.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) scores 4.3 and indicates a low-complexity, network-reachable attack requiring only subscriber-level authentication, with impact limited to partial confidentiality loss and no integrity or availability consequence. EPSS data is not provided, and there is no CISA KEV listing, making real-world exploitation unconfirmed. No public proof-of-concept code is noted in the available data. The practical risk is constrained by the requirement for a valid WordPress account (even at the lowest role), meaning open-registration sites or sites with many low-trust users face higher exposure. The absence of integrity impact limits the attack's usefulness beyond information disclosure. This is a medium-priority issue - not a critical fire drill, but warrants prompt patching on any site allowing public user registration.

An attacker registers a free account on a WordPress site running Query Wrangler 1.5.57 or earlier and logs in as a subscriber. By sending a crafted authenticated HTTP request to the vulnerable plugin endpoint - requiring no elevated privileges or special conditions beyond a valid session - the attacker retrieves data or accesses functionality intended only for administrators, such as query configurations or plugin settings, obtaining limited information disclosure. No public proof-of-concept is identified at time of analysis.