CVE-2026-14498

The vulnerability in Query Wrangler below version 1.5.58 stems from a specific architectural failure: an AJAX handler that accepts attacker-controlled options and passes them to `call_user_func_array()` without any capability verification. The `function_exists()` guard that precedes the dynamic function call does not constitute a security control—it is a runtime availability check that answers 'does this function exist?' rather than 'is this user permitted to invoke it?' This distinction matters because developers frequently conflate availability with authorization, particularly in WordPress plugin ecosystems where flexibility pressures drive dynamic dispatch patterns. The most critical detail is the subscriber-level access. WordPress AJAX handlers are accessible to any authenticated user by default unless explicitly gated with `current_user_can()`. This handler lacks that check entirely, meaning any valid WordPress account—including subscriber-level users—can trigger the dynamic function call. Combined with an enumerable `query_id` (auto-incrementing integer IDs starting from 1), an attacker needs no credentials beyond a basic user account, no nonce, and no guesswork to target saved query configurations. The blast radius extends beyond this single plugin. The pattern of `function_exists()` guarding `call_user_func_array()` in AJAX handlers has appeared in multiple prior WordPress plugin CVEs, suggesting structural incentives in plugin development that reproduce this vulnerability class. Even if every instance of this pattern were patched in this plugin, the missing authorization gate, absent nonce verification, and enumerable identifiers would remain as independent vulnerabilities. For remediation, verify that the AJAX handler explicitly gates access via `current_user_can('manage_options')` or equivalent privilege, remove dynamic function dispatch if possible, and consider whether `query_id` enumeration is acceptable in the threat model. The CVSS 8.8 score reflects severity, but the systemic exposure window in WordPress plugin ecosystems is effectively instantaneous upon disclosure—every scanner targets known-vulnerable versions immediately, unlike enterprise software where target-specific reconnaissance is required.

Reviewed through automated stages and approved by a human before publication.