CVE-2026-14498
Received Received - Intake

Remote Code Execution in Query Wrangler WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-14498
EUVD
EUVD-2026-59852

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
query_wrangler query_wrangler to 1.5.57 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Query Wrangler WordPress plugin up to version 1.5.57 has a Remote Code Execution vulnerability. It allows authenticated attackers with subscriber-level access or higher to execute arbitrary code on the server. The flaw exists due to missing capability checks and nonce verification in the wp_ajax_qw_form_ajax handler. Attackers can replace saved query options with malicious ones and pass them to call_user_func_array(), leading to code execution if a function exists.

Detection Guidance

Detection requires checking for the Query Wrangler plugin version 1.5.57 or lower in WordPress. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin directory for version files. Look for suspicious AJAX calls to 'wp_ajax_qw_form_ajax' in server logs.

Impact Analysis

If you use the Query Wrangler plugin in WordPress, an attacker could gain control of your website. They could execute malicious code, steal data, install backdoors, or deface your site. The attack requires only subscriber-level access and at least one existing query row in the database.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in exposure of sensitive user data, leading to legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately update the Query Wrangler plugin to the latest version. If an update is unavailable, disable the plugin entirely. Review server logs for signs of exploitation and restrict subscriber-level access to sensitive functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart