External risk intelligence

Query Wrangler Subscriber RCE Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-73992

Query Wrangler is a WordPress plugin. WordPress plugins are typically used in web-facing applications, making their functionality frequently reachable via the public internet as part of the host website's web interface.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Query Wrangler, a component used within web applications. This issue could allow unauthorized individuals to execute code remotely, potentially impacting the integrity and availability of services. The main concern at this time is to confirm if this technology is in use and assess any potential exposure.

Remote code execution flaw found in software.
Affects web applications, potentially impacting services.
Confirm use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by accessing a web application that uses the Query Wrangler plugin. If the attacker has authenticated as a subscriber, they can interact with the plugin's features. Specifically, by sending a specially crafted request to the Query Wrangler component, the attacker could trigger a vulnerability that allows them to execute arbitrary code on the server. This could lead to a complete compromise of the application and its data.

Requires authenticated subscriber access.
Triggered by a crafted request to the component.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When Query Wrangler is used in a web-facing application, an authenticated attacker with low privileges could exploit this vulnerability to execute arbitrary code on the server. This could lead to a complete compromise of the affected system.

Server-side code execution.
Exploited via a network request.
Full system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Query Wrangler, a WordPress plugin, impacts subscriber RCE and requires immediate attention from application owners and platform teams. The first practical step is to inventory all WordPress instances, confirm reachability and business criticality of Query Wrangler, identify the accountable owner, and then prioritize remediation based on risk.

Application owners should own the issue.
Verify Query Wrangler's presence and reachability.
Plan remediation based on verified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Query Wrangler?

Query Wrangler is a WordPress plugin designed to help site administrators create and manage custom database queries through a graphical interface. By integrating directly into the WordPress ecosystem, it allows users to display dynamic content from the database on their sites without writing custom SQL code.

What does CWE-94 mean for CVE-2026-73992?

CWE-94 refers to improper control of generation of code, often called Code Injection. In the context of CVE-2026-73992, this means the plugin does not properly sanitize or restrict user-provided input, allowing an attacker to supply their own instructions that the server then executes as if they were part of the application's legitimate code.

How is this vulnerability triggered?

An attacker must be authenticated as a subscriber on the WordPress site to trigger this flaw. The vulnerability is activated by sending a specifically crafted request to the plugin. Simply browsing the site as a guest or having no account does not trigger the bug, as it requires the permissions associated with a registered subscriber account.

Why does Halo Surface Signal flag this as relevant?

Halo Surface Signal flags this as likely relevant because Query Wrangler is a WordPress plugin. Since these plugins are integral to web-facing applications, they are typically reachable via the public internet. This connectivity increases the surface area for potential attacks, as the functionality is often exposed to anyone who can reach the host website.

Do I need to take action if I use Query Wrangler?

Yes, you should verify if your environment is running the affected versions of the plugin. Start by inventorying your WordPress instances to confirm where Query Wrangler is active. Once identified, work with your team to determine the plugin's business criticality and prepare to apply updates or implement access controls to mitigate risk.

References

patchstack.com/database/wordpress/plugin/query-wrangler/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.