Remote Code Execution in Query Wrangler WordPress Plugin

The Query Wrangler plugin for WordPress, in versions up to and including 1.5.57, contains a critical Remote Code Execution (RCE) vulnerability identified as CVE-2026-14498. The flaw resides in the wp_ajax_qw_form_ajax handler, which processes requests without performing nonce verification or capability checks. An attacker with minimal privileges (subscriber level) can manipulate the 'options' parameter to inject malicious query configurations. Because these options are passed directly to the PHP call_user_func_array() function with insufficient validation beyond a function_exists() check, an attacker can trigger the execution of arbitrary server-side functions. This vulnerability is particularly dangerous because the query_id used in the handler is an enumerable integer, making it trivial for an attacker to identify an existing target row in the database and execute the exploit payload.

Impact

Successful exploitation of CVE-2026-14498 grants an attacker the ability to execute arbitrary PHP code on the underlying web server. This can lead to full site compromise, data exfiltration, and lateral movement within the hosting environment. While the vulnerability requires subscriber-level authentication, the low barrier to entry and the ease of identifying targets via query_id enumeration significantly increase the risk profile for WordPress installations running this plugin.

Recommendation

• Upgrade the Query Wrangler plugin to the latest version immediately to remediate CVE-2026-14498.
• Review web server access logs for anomalous POST requests directed at wp-admin/admin-ajax.php involving the qw_form_ajax action.
• Audit subscriber-level account activity for patterns of repeated requests targeting sequential query_id integers.
• Apply the following webserver detection logic to identify potential exploitation attempts in environment logs.