Query Wrangler
Monthly
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-level users to access restricted functionality beyond their intended permissions. The CWE-862 (Missing Authorization) root cause indicates the plugin fails to verify whether the requesting user holds sufficient privileges before executing sensitive operations. No active exploitation is confirmed in CISA KEV, and CVSS rates this a medium-severity (4.3) network-exploitable issue with limited confidentiality impact and no integrity or availability consequence.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-level users to access restricted functionality beyond their intended permissions. The CWE-862 (Missing Authorization) root cause indicates the plugin fails to verify whether the requesting user holds sufficient privileges before executing sensitive operations. No active exploitation is confirmed in CISA KEV, and CVSS rates this a medium-severity (4.3) network-exploitable issue with limited confidentiality impact and no integrity or availability consequence.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.