CVE-2026-14498 is a high-severity remote code execution vulnerability in the Query Wrangler WordPress plugin. The flaw arises from the wp_ajax_qw_form_ajax handler lacking proper capability checks and nonce verification, allowing authenticated attackers with low privileges to supply malicious 'options' data. This data replaces saved query options and is passed directly to call_user_func_array(), guarded only by function_exists(), enabling arbitrary code execution. The vulnerability requires at least one existing query row and uses an enumerable query_id without further access restrictions.

An attacker with subscriber-level or higher access can execute arbitrary code on the server hosting the vulnerable Query Wrangler plugin. This compromises confidentiality, integrity, and availability of the affected system, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to prevent untrusted users from accessing the vulnerable functionality and monitor for suspicious activity related to the plugin.