Jonathan Daggerhart
Monthly
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
A Code Injection vulnerability (CWE-94) exists in the Jonathan Daggerhart Widget Wrangler WordPress plugin through version 2.3.9, allowing unauthenticated attackers to execute arbitrary code on affected installations. This Remote Code Execution (RCE) vulnerability enables complete server compromise and data exfiltration. Active exploitation has been documented by Patchstack, indicating this is a practical, real-world threat requiring immediate patching.
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-level users to access restricted functionality beyond their intended permissions. The CWE-862 (Missing Authorization) root cause indicates the plugin fails to verify whether the requesting user holds sufficient privileges before executing sensitive operations. No active exploitation is confirmed in CISA KEV, and CVSS rates this a medium-severity (4.3) network-exploitable issue with limited confidentiality impact and no integrity or availability consequence.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
A Code Injection vulnerability (CWE-94) exists in the Jonathan Daggerhart Widget Wrangler WordPress plugin through version 2.3.9, allowing unauthenticated attackers to execute arbitrary code on affected installations. This Remote Code Execution (RCE) vulnerability enables complete server compromise and data exfiltration. Active exploitation has been documented by Patchstack, indicating this is a practical, real-world threat requiring immediate patching.
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-level users to access restricted functionality beyond their intended permissions. The CWE-862 (Missing Authorization) root cause indicates the plugin fails to verify whether the requesting user holds sufficient privileges before executing sensitive operations. No active exploitation is confirmed in CISA KEV, and CVSS rates this a medium-severity (4.3) network-exploitable issue with limited confidentiality impact and no integrity or availability consequence.