CVE-2026-14498

Name of the Vulnerable Software and Affected Versions Query Wrangler versions prior to 1.5.58

Description Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution on the server. The issue exists in the wp ajax qw form ajax handler due to a lack of capability checks and nonce verification. Unsanitized data provided via the options parameter can replace saved query options and be passed to the call user func array() function, which is only protected by a function exists() check. Exploitation is possible if at least one query row exists in the database, as the query id is a small enumerable integer without additional access controls.

Recommendations Update Query Wrangler to a version newer than 1.5.57. As a temporary mitigation, restrict access to the wp ajax qw form ajax handler or avoid using the options parameter until the update is applied.