A flaw in the Query Wrangler plugin for WordPress permits attackers to forge HTTP requests that are processed as if they were made by an authenticated user. The weakness, classified as CWE‑352, means that the plugin does not adequately verify the origin or authenticity of incoming requests. If exploited, an attacker could trigger arbitrary administrative actions or database queries through the plugin interface, leading to unauthorized data modification or exposure.

WordPress sites that have installed Jonathan Daggerhart’s Query Wrangler plugin version 1.5.54 or earlier are susceptible. These sites could be running any recent WordPress release that supports the plugin, regardless of which theme or other plugins are present.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to expose victims to risk by sending crafted requests from a malicious domain to the target site, relying on the victim’s authenticated session to execute the unauthorized action.