CVE-2026-14498 in Query Wrangler Plugin
Summary
by MITRE • 08/16/2026
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
The Query Wrangler plugin for WordPress presents a critical remote code execution vulnerability affecting all versions through 1.5.57. This security flaw stems from inadequate input validation and privilege verification within the wp_ajax_qw_form_ajax handler, creating an exploitable pathway for authenticated attackers. The vulnerability manifests through the 'options' parameter which lacks proper capability checks and nonce verification mechanisms, allowing unauthorized code execution on affected systems.
The technical implementation of this vulnerability leverages multiple security weaknesses that compound to create a dangerous attack vector. Attackers with subscriber-level privileges or higher can manipulate the options parameter to fully replace existing query options within the database. These unsanitized inputs are then passed directly to call_user_func_array() function, which only verifies function existence through function_exists() checks rather than comprehensive validation. This design flaw enables arbitrary code execution because the plugin does not properly sanitize or validate user-supplied data before processing it as executable code.
The operational impact of this vulnerability is significant given the minimal prerequisites required for exploitation. Attackers need only ensure that at least one query row exists in the database, as the query_id parameter uses small enumerable integers without additional access controls. This makes the attack surface easily exploitable across various WordPress installations where the Query Wrangler plugin is active. The vulnerability affects systems where users with subscriber-level permissions or higher can submit data through the plugin's AJAX handler, potentially allowing full server compromise.
Security mitigation strategies should focus on immediate patching to version 1.5.58 or later which addresses these validation and privilege checking issues. Organizations should implement network segmentation to limit access to WordPress admin interfaces and consider implementing web application firewalls to detect suspicious AJAX requests. Additionally, administrators should review and reduce user privileges where possible, ensuring that only trusted users have access to plugin configuration features. The vulnerability aligns with CWE-79 (Cross-site Scripting) and CWE-94 (Code Injection) categories while mapping to ATT&CK techniques including T1059 (Command and Scripting Interpreter) and T1133 (External Remote Services). Regular security audits of WordPress plugins should include verification of nonce implementation, capability checks, and input sanitization practices to prevent similar vulnerabilities from emerging in the future.