CVE-2026-73992
CriticalCVSS 9.9Summary
Subscriber Remote Code Execution (RCE) vulnerability in the Query Wrangler plugin. Affects versions up to 1.5.57.
Risk Assessment
A user with low privileges can execute arbitrary code on the server, potentially leading to full system compromise.
Recommendation
Immediately update the Query Wrangler plugin to the latest version and restrict user permissions.
Other vulnerabilities in Query Wrangler
See all- CVE-2026-65491Medium
The Query Wrangler plugin versions 1.5.57 and earlier have a broken access control vulnerability exploitable by a subscriber. A user with subscriber role can gain unauthorized access to functions or data.
- CVE-2026-14498High
The Query Wrangler plugin for WordPress up to version 1.5.57 contains a remote code execution vulnerability. Missing capability check and nonce verification in the AJAX handler allow authenticated attackers with Subscriber-level access to execute code on the server.
Original NVD description (English source)
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS