Enis

**Name of the Vulnerable Software and Affected Versions** Query Wrangler versions prior to 1.5.58 **Description** Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution on the server. The issue exists in the `wp ajax qw form ajax` handler due to a lack of capability checks and nonce verification. Unsanitized data provided via the `options` parameter can replace saved query options and be passed to the `call user func array()` function, which is only protected by a `function exists()` check. Exploitation is possible if at least one query row exists in the database, as the `query id` is a small enumerable integer without additional access controls. **Recommendations** Update Query Wrangler to a version newer than 1.5.57. As a temporary mitigation, restrict access to the `wp ajax qw form ajax` handler or avoid using the `options` parameter until the update is applied.