Query Wrangler

Query Wrangler <= 1.5.57 allows a Subscriber to execute code on the WordPress server. Successful exploitation can compromise site data, application integrity and availability under the web server account.

Query Wrangler through 1.5.57 exposes wp_ajax_qw_form_ajax without a capability check or nonce. A Subscriber can replace a saved query row's options through the options parameter; the plugin later passes those attacker-selected values to call_user_func_array(), guarded only by function_exists(). With any enumerable query row present, this permits server-side code execution. The public.

Query Wrangler is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 1.5.57.

Query Wrangler is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Query Wrangler is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.