Description

Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-20T12:16:36.563Z",
  "pubdate": "2026-08-20T12:16:36.563Z",
  "executiveSummary": "A Remote Code Execution vulnerability exists in the Query Wrangler plugin for WordPress, specifically affecting versions 1.5.57 and prior. The security flaw allows authenticated users with subscriber-level privileges to execute arbitrary system code on the underlying host server. This vulnerability stems from improper input validation and insufficient access controls within the query execution handling mechanisms of the software. The impact of successful exploitation is critical, potentially leading to total compromise of the affected WordPress instance, unauthorized data access, lateral movement within the network, and complete system takeover by malicious actors. The risk implications are severe given that subscriber accounts are often publicly registerable or easily obtainable via social engineering. Attack capabilities include full system command execution under the privileges of the web server process. Exploitation requirements involve authenticated access to the target application with at least subscriber privileges, allowing malicious actors to interact directly with vulnerable endpoints and submit specially crafted payloads designed to trigger code evaluation.",
  "technicalDetails": "The vulnerability resides in the core query processing and execution routines of the Query Wrangler plugin affecting versions <= 1.5.57. The root cause is characterized by a failure in input sanitization and authorization enforcement, wherein parameters submitted by low-privileged users are improperly handled and passed into evaluation sinks. Specifically, the application fails to restrict functional capabilities to administrative roles, permitting users assigned the subscriber role to invoke administrative-level functionalities.\nThe exploitation method relies on the transmission of malicious HTTP requests containing serialized data, dynamic code constructs, or improperly filtered template parameters to vulnerable endpoints exposed by Query Wrangler. When the application processes the incoming request, it fails to validate whether the initiating user possesses the requisite administrative privileges. Consequently, the input is parsed and executed by the PHP interpreter running on the web server.\nThe attack flow proceeds as follows: First, an authenticated attacker with a subscriber account crafts an HTTP request targeting the vulnerable component within Query Wrangler. Second, the attacker injects a payload designed to execute system commands or evaluate arbitrary PHP code into the susceptible parameter. Third, the application processes the request without enforcing strict capability checks or sanitizing the input stream. Fourth, the injected payload reaches the execution sink where it is evaluated by the server, resulting in Remote Code Execution.\nThe vulnerable component encompasses the backend processing logic responsible for handling dynamic query parameters and rendering template contents within Query Wrangler versions <= 1.5.57. Network exposure is broad, as any internet-facing WordPress instance running the affected plugin exposes the vulnerable endpoints over HTTP and HTTPS protocols. Authentication is required, but the privilege level is restricted only to the low-privileged subscriber tier, drastically lowering the barrier to entry for potential attackers. Payload behavior typically involves spawning a reverse shell, executing operating system commands, or writing malicious web shells to the web root for persistent access. The post-exploitation impact includes full administrative control over the WordPress database, ability to manipulate file systems, pivot to internal network resources, and exfiltrate sensitive application data."
}