Remote Code Execution Vulnerability in Query Wrangler Plugin for WordPress

CVE-2026-14498

What is CVE-2026-14498?

The Query Wrangler plugin for WordPress has a vulnerability that allows authenticated attackers with subscriber-level access and higher to execute arbitrary code on the server. This issue arises from a lack of proper capability checks and nonce verification in the 'wp_ajax_qw_form_ajax' handler, along with the unsanitized handling of user-inputted options that can overwrite saved query options. Attackers can exploit this vulnerability if at least one query row exists in the database, as the query_id is a small enumerable integer without additional access controls.

References