The Query Wrangler plugin for WordPress has a flaw that allows attackers to execute arbitrary code on the host server. The vulnerability resides in subscriber handling, permitting injection of executable payloads that are run with the permissions of the WordPress installation. This leads to a full compromise of confidentiality, integrity, and availability for affected sites, potentially enabling attackers to install malware, exfiltrate data, or take control of the web server.

The affected product is the Query Wrangler plugin developed by Jonathan Daggerhart. Versions 1.5.57 and earlier are vulnerable; any WordPress site that has those plugin versions installed is at risk.

The CVSS score of 9.9 reflects a high-severity remote code execution. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of publicly disclosed exploits does not reduce the inherent risk. Attackers can target the plugin’s subscriber interface from over the network, and no special conditions are required beyond site access. The vulnerability’s severity and remote nature make it a high priority for remediation.