CVE-2024-50498

CVE-2024-50498 is an improper control of code generation (CWE-94) flaw in the WP Query Console WordPress plugin by Ajit Bohra/LUBUS, allowing remote code injection. According to the CVSS vector, it is exploitable over the network with low complexity, no privileges and no user interaction, meaning an unauthenticated attacker can trigger it by sending a crafted request to an affected site. Successful exploitation yields full remote code execution impact (high confidentiality, integrity and availability), letting the attacker run arbitrary code on the WordPress host. Any WordPress site running WP Query Console version 1.0 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, though its EPSS score is high (~53% chance of exploitation within 30 days) and related reporting describes attackers chaining WordPress plugin flaws (e.g., the Hunk Companion issue) to silently install vulnerable plugins, which could bring this plugin onto otherwise unaffected sites.

What to do: Update WP Query Console to a version newer than 1.0 (the latest patched release) or deactivate and delete the plugin if it is not actively needed, since it is a developer tool rarely required in production. Internet-facing WordPress sites should be prioritized given the critical severity and high EPSS score. Check whether the related Hunk Companion plugin flaw was used to silently install WP Query Console or other vulnerable plugins on your sites.