Executive Summary
A high-severity Remote Code Execution vulnerability (CVE-2026-14498) has been disclosed in the Query Wrangler plugin for WordPress. The flaw carries a CVSS score of 8.8 and enables authenticated attackers — with as little as subscriber-level access — to inject and execute arbitrary PHP code on affected WordPress servers.
CVSS Score: 8.8 (High)
The vulnerability exists in the wp_ajax_qw_form_ajax AJAX handler, which is missing both a capability check and nonce verification. Combined with unsanitized user-supplied input passed into the plugin's options parameter, this creates a code injection pathway that leads to full Remote Code Execution. All versions up to and including 1.5.57 are affected.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-14498 |
| CVSS Score | 8.8 (High) |
| Type | Remote Code Execution via Missing Auth & Unsanitized Input |
| Attack Vector | Network |
| Privileges Required | Low (authenticated subscriber) |
| User Interaction | None |
| Affected Plugin | Query Wrangler |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| Query Wrangler | <= 1.5.57 | Pending / Uninstall |
Technical Details
The vulnerability is rooted in the AJAX handler wp_ajax_qw_form_ajax in the Query Wrangler plugin. Two independent security controls are absent:
- Missing capability check — any authenticated WordPress user (including subscribers) can invoke the handler
- Missing nonce verification — no CSRF token is validated, broadening the attack surface
The options parameter passed through this handler is not sanitized before being used in a code path that eventually results in PHP code execution via eval() or equivalent unsafe PHP constructs. An attacker who can supply crafted options values can execute arbitrary commands on the server.
Attack Flow
1. Attacker registers or obtains a low-privilege WordPress account (subscriber)
2. Attacker sends crafted AJAX POST to wp-admin/admin-ajax.php
action=qw_form_ajax&options=<malicious_payload>
3. qw_form_ajax handler runs without capability or nonce check
4. Unsanitized options parameter reaches PHP code execution sink
5. Arbitrary PHP executes as the web server user
6. Attacker gains shell access, exfiltrates data, or pivots to hostImpact Matrix
| Impact | Description |
|---|---|
| Remote Code Execution | Execute arbitrary PHP/system commands |
| Data Exfiltration | Read wp-config.php, database contents, user data |
| Privilege Escalation | Create rogue WordPress admin accounts |
| Webshell Deployment | Persist backdoor across plugin updates |
| Lateral Movement | Pivot to other sites on shared hosting |
Remediation
Step 1: Deactivate and Remove the Plugin
No patched version of Query Wrangler has been released. Remove it immediately.
# Via WP-CLI
wp plugin deactivate query-wrangler
wp plugin delete query-wranglerOr via WordPress admin: Plugins > Installed Plugins > Query Wrangler > Deactivate > Delete.
Step 2: Check for Existing Compromise
# Look for recently created PHP files in web-accessible directories
find /path/to/wordpress/wp-content/ -name "*.php" \
-newer /path/to/wordpress/wp-settings.php -type f
# Search for common webshell patterns
grep -rl "eval\s*(base64_decode" /path/to/wordpress/wp-content/
grep -rl "system\s*(" /path/to/wordpress/wp-content/uploads/
# Verify WordPress admin accounts
wp user list --role=administratorStep 3: WAF Rule (Temporary Mitigation)
If removing the plugin immediately is not possible:
# Block requests to the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
if ($arg_action = "qw_form_ajax") {
return 403;
}
}Step 4: Review AJAX Handler Registrations
# Grep for qw_form_ajax references in plugin files
grep -r "qw_form_ajax" /path/to/wordpress/wp-content/plugins/query-wrangler/Detection Indicators
| Indicator | Description |
|---|---|
POST to admin-ajax.php with action=qw_form_ajax | Exploitation attempt |
Unexpected PHP files in wp-content/uploads/ | Webshell drop |
| New unauthorized administrator accounts | Post-exploitation persistence |
| Outbound network connections from web process | Data exfiltration or C2 |
PHP errors referencing Query Wrangler options parameter | Failed exploit attempt |
Post-Remediation Checklist
- Remove Query Wrangler from all installations
- Scan for webshells and unauthorized file modifications
- Audit all WordPress administrator accounts
- Rotate database credentials and WordPress secret keys (
wp config shuffle-salts) - Review access logs for exploitation evidence (suspicious
admin-ajax.phpPOST requests) - Restore from a known-good backup if compromise is confirmed
- Deploy a WAF with plugin-specific ruleset (Wordfence, Sucuri)