Wordfence Advisory: Query Wrangler <=1.5.57 Authenticated RCE via options Parameter (CVE-2026-14498)

Vulnerability Overview Vulnerability Name: Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter CVE ID: CVE-2026-14498 CVSS Score: 8.8 (High) Publication Date: August 15, 2026 Last Updated Date: August 16, 2026 Researcher: Enis - TURKOL YAZILIM Affected Scope Software Type: Plugin Software Name: Query Wrangler Affected Versions: <= 1.5.57 Fixed Version: 1.5.8 Remediation Remediation Measure: Update to version 1.5.58 or later patched versions Vulnerability Description The Query Wrangler plugin contains a remote code execution vulnerability in all WordPress versions, including 1.5.57, exploitable via the 'options' parameter. This vulnerability arises from the lack of capability checks and nonce validation, along with an attacker-controlled options array completely overwriting saved options and being passed directly to , protected only by . This allows an authenticated attacker (at Subscriber level or above) to execute code on the server. The exploitation condition requires only that at least one query row exists in the database, as is a small, enumerable integer that requires no further access control. References plugins.trac.wordpress.org Sharing Options Facebook X (Twitter) LinkedIn Email Additional Information Recently Discovered Vulnerabilities: - Query Wrangler <= 1.5.57 - Missing Authorization (CVE-2026-65491, CVSS 4.3, Que Thanh Tuan, July 22, 2026) - Query Wrangler <= 1.5.54 - Cross-Site Request Forgery (CVE-2025-31779, CVSS 4.3, Skalucy, April 1, 2025) - Query Wrangler <= 1.5.51 - Reflected Cross-Site Scripting via page parameter (CVE-2023-30779, CVSS 6.1, LEE SE HYOUNG, April 19, 2023) Copyright Information Copyright: 2012-2026 Defiant Inc. License: Creative Commons Attribution-ShareAlike 4.0 International License Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, 365 days a year, 1-hour response time Additional Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Twitter Facebook Instagram LinkedIn Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe for Updates Subscribe: Enter email address to subscribe to news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Miscellaneous Wordfence Intelligence: Completely free, providing personal and commercial API access, containing all the same vulnerability data as the user interface. Summary This page details a remote code execution vulnerability in the Query Wrangler plugin, providing specific vulnerability information, affected scope, remediation measures, as well as relevant reference links and copyright information.

Goal Reached Thanks to every supporter — we hit 100%!

Wordfence Advisory: Query Wrangler <=1.5.57 Authenticated RCE via options Parameter (CVE-2026-14498)

More from this source