CVE-2026-65491
MediumCVSS 4.3Summary
The Query Wrangler plugin versions 1.5.57 and earlier have a broken access control vulnerability exploitable by a subscriber. A user with subscriber role can gain unauthorized access to functions or data.
Risk Assessment
The risk involves the possibility of unauthorized access to sensitive functions or data by low-privilege users, potentially leading to security breaches.
Recommendation
It is recommended to update the Query Wrangler plugin to a version newer than 1.5.57 that fixes this vulnerability.
Other vulnerabilities in Query Wrangler
See all- CVE-2026-73992Critical
Subscriber Remote Code Execution (RCE) vulnerability in the Query Wrangler plugin. Affects versions up to 1.5.57.
- CVE-2026-14498High
The Query Wrangler plugin for WordPress up to version 1.5.57 contains a remote code execution vulnerability. Missing capability check and nonce verification in the AJAX handler allow authenticated attackers with Subscriber-level access to execute code on the server.
Original NVD description (English source)
Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.