WordPress security changelog
HIGH CVE-2026-14498 Deferred

Query Wrangler AJAX options replacement permits Subscriber code execution

Query Wrangler through 1.5.57 exposes wp_ajax_qw_form_ajax without a capability check or nonce. A Subscriber can replace a saved query row's options through the options parameter; the plugin later passes those attacker-selected values to call_user_func_array(), guarded only by function_exists(). With any enumerable query row present, this permits server-side code execution. The public.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Query Wrangler
Plugin slug
query-wrangler
Affected
<= 1.5.57
Safe version
1.5.58
Published
Aug 16, 2026
Weakness
CWE-434 — Unrestricted Upload of File with Dangerous Type

This CVE was published Aug 16, 2026 and is one of 5 known issues for this plugin.

What to do

Update, patch or deactivate.

The official author release notes confirm remediation by 1.5.58; this does not establish that every intervening release was affected. Update the affected edition to 1.5.58 or a later maintained release on its supported branch. deactivate Query Wrangler when warranted, restrict untrusted accounts, and inspect saved queries, files, and process activity for compromise. Official author release notes: https://zh-hk.wordpress.org/plugins/query-wrangler/.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources