Description

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-16T05:16:46.360Z",
  "pubdate": "2026-08-16T05:16:46.360Z",
  "executiveSummary": "The Query Wrangler plugin for WordPress is susceptible to a critical Remote Code Execution vulnerability affecting all versions up to, and including, 1.5.57. This security flaw enables authenticated attackers with minimal privileges, specifically subscriber-level access and above, to execute arbitrary PHP code on the underlying server. The vulnerability stems from a combination of missing authorization controls, inadequate input sanitization, and the dangerous execution of attacker-supplied data via dynamic function invocation handlers.\nThe primary impact of this vulnerability is complete system compromise, allowing attackers to execute arbitrary system commands, manipulate the database, or pivot deeper into the internal network. Exploitation of this flaw requires specific conditions to be met: at least one query row must exist within the database, and the attacker must leverage the predictable and enumerable nature of the query_id parameter. Given the low privilege requirement of a subscriber account and the high-severity impact, this vulnerability poses significant risk implications for any WordPress installation utilizing the affected plugin versions.",
  "technicalDetails": "The root cause of the Remote Code Execution vulnerability in the Query Wrangler plugin lies within the wp_ajax_qw_form_ajax AJAX handler. The application fails to implement proper capability checks and lacks nonce verification, thereby exposing the endpoint to any authenticated user regardless of their assigned role or administrative standing. Furthermore, the vulnerability is exacerbated by the handling of the 'options' parameter, which accepts unsanitized attacker-controlled data and permits it to fully overwrite saved query options within the database.\nDuring execution, these attacker-controlled query options are passed directly to the PHP function call_user_func_array() construct. This dangerous sink is guarded only by a rudimentary function_exists() check, which validates the existence of the specified callable function without restricting it to a safe whitelist of intended operations. Consequently, an attacker can supply arbitrary PHP functions and parameters to be executed within the context of the web server.\nThe attack flow proceeds through a series of deterministic steps. First, an attacker authenticates with subscriber-level privileges or higher. Second, the attacker identifies a valid target via the query_id, which is implemented as a small enumerable integer lacking further access control, provided that at least one query row exists in the database. Third, the attacker crafts a malicious HTTP request targeting the wp_ajax_qw_form_ajax handler, injecting malicious payloads into the 'options' parameter. Finally, the server processes the request, deserializes or assigns the unsanitized options, and invokes call_user_func_array() with the attacker's supplied function and arguments, resulting in immediate remote code execution."
}