Query Wrangler EUVD-2026-63311

Exploitation requires an authenticated account at subscriber level or higher (CVSS PR:L), so the attacker must be able to obtain such an account - trivial on sites with open self-registration, which is the common WordPress default for community/comment features, but a hard blocker on sites that disable registration. The affected software must be the Query Wrangler plugin at version 1.5.57 or earlier and active. No user interaction, elevated privileges, or non-default plugin configuration is indicated as necessary beyond having the plugin installed and the attacker holding a low-privilege login; the primary limiting factor is availability of a subscriber account.

Multiple signals point to genuine priority rather than an inflated CVSS number. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H combines network reach, low complexity, no user interaction, and a scope change, and the required privilege is only subscriber-level - a role that is auto-granted on any WordPress site permitting open registration, which is extremely common. That makes the practical barrier to exploitation very low wherever open registration is enabled. Countervailing factors: no EPSS score is provided, the vulnerability is not on the CISA KEV list, and no public exploit or SSVC decision data is available, so I cannot confirm active or automatable exploitation - the urgency rests on the severity of the flaw and the ease of obtaining the required privilege, not on observed attacks. Given that RCE yields full host compromise, any operator running an affected version on an internet-facing site with registration enabled should treat this as urgent and prioritize remediation; conversely, sites that disable self-registration and restrict subscriber accounts meaningfully raise the bar for an attacker.

An attacker registers or obtains a subscriber-level account on a WordPress site running Query Wrangler <= 1.5.57, then sends a crafted request to the vulnerable plugin endpoint that injects code the application evaluates, achieving remote code execution on the server. Because no user interaction is required and complexity is low, the request can be fully scripted once the account exists; no public exploit code is identified at time of analysis.