The Query Wrangler plugin for WordPress versions up to and including 1.5.57 allows an authenticated user with subscriber‑level or higher access to execute arbitrary code. The issue originates from the wp_ajax_qw_form_ajax handler which lacks capability checks and nonce verification, and from the unsanitized 'options' parameter that is passed directly to call_user_func_array guarded only by function_exists(). An attacker can replace stored query options with malicious callbacks, forcing the plugin to invoke attacker‑controlled code on the server.

Affected systems are all WordPress installations that have the Query Wrangler plugin installed with a version ≤1.5.57. The vulnerability resides in the plugin’s core code, so any site using the plugin—regardless of theme or additional plugins—is at risk if subscriber or higher level users can access the admin area.

The flaw has a CVSS score of 8.8, reflecting high severity, and no EPSS score is publicly available; it is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with subscriber or higher privileges and the presence of at least one query row in the database—an easily satisfied condition. Once the crafted AJAX request is sent, the attacker can run arbitrary PHP code, leading to full compromise of confidentiality, integrity, and availability. The attack vector is web‑application level from an authenticated session, but the impact is equivalent to a server‑wide remote code execution.