EUVD-2026-63311
GHSA-9gcp-fwvg-c9v7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity code injection needing only a subscriber account (PR:L), yielding RCE that escapes the app to the host (S:C) with full CIA impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
AnalysisAI
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account at subscriber level or higher (CVSS PR:L), so the attacker must be able to obtain such an account - trivial on sites with open self-registration, which is the common WordPress default for community/comment features, but a hard blocker on sites that disable registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals point to genuine priority rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains a subscriber-level account on a WordPress site running Query Wrangler <= 1.5.57, then sends a crafted request to the vulnerable plugin endpoint that injects code the application evaluates, achieving remote code execution on the server. Because no user interaction is required and complexity is low, the request can be fully scripted once the account exists; no public exploit code is identified at time of analysis. |
| Remediation | No vendor-released patch version is identified in the available data, so a specific 'upgrade to version X' cannot be cited from the input; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/query-wrangler/vulnerability/wordpress-query-wrangler-plugin-1-5-57-remote-code-execution-rce-vulnerability) for an updated release and apply it as the primary fix once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable WordPress user self-registration site-wide or immediately deactivate the Query Wrangler plugin to eliminate the attack vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Query Wrangler
View allRemote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing a
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-leve
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today