The Query Wrangler plugin for WordPress suffers from a broken access control flaw in all releases up to and including version 1.5.57. The vulnerability originates from the plugin’s failure to enforce proper authorization checks, allowing a user with the subscriber role to perform actions or view data that should be restricted to higher‑privileged users such as administrators or editors. The weakness is classified as CWE‑862. Because the flaw permits privilege escalation within the WordPress environment, the potential impact is limited to data disclosure or modification that is otherwise protected for users with elevated roles, and the CVSS score of 4.3 reflects a moderate severity.

Jonathan Daggerhart’s Query Wrangler plugin, deployed on WordPress sites where the plugin version is 1.5.57 or older. All installations of the plugin in these or earlier versions are potentially vulnerable until updated to a non‑affected release.

The EPSS score of less than 1% and the fact that this vulnerability is not listed in CISA’s KEV catalog suggest a low likelihood of exploitation in the wild. Based on the description, the likely attack vector involves legitimate subscriber role actions or HTTP requests to plugin endpoints that bypass authorization checks, without any indication that additional conditions such as injection or other vulnerabilities are required. The overall risk remains moderate, with the primary threat being unauthorized access to data normally reserved for higher‑privileged users.