CVE-2024-50498

What it actually does

CVE-2024-50498 is an unauthenticated remote code injection vulnerability in the WP Query Console WordPress plugin through version 1.0. The flaw allows attacker-controlled input to influence generated code, potentially resulting in arbitrary PHP execution in the context of the WordPress application and web server user. Because it is network-exploitable, requires no privileges or user interaction, and has a CVSS score of 10.0, successful exploitation can lead to full compromise of the affected WordPress site, including data theft, content modification, backdoor installation, and service disruption.

Why it matters to the business

A vulnerable site can be fully taken over remotely, which may result in defacement, malware hosting, credential theft, customer data exposure, SEO poisoning, spam campaigns, or use of the server as a foothold for broader attacks. The exploit is reported as weaponized and has a high EPSS score, so internet-facing WordPress installations using this plugin should be treated as high-priority remediation targets even though the vulnerability is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies WordPress sites with the WP Query Console plugin installed, commonly by probing for the plugin directory or related assets. If the vulnerable plugin is present, the attacker sends crafted requests containing code-like payloads to the vulnerable functionality. Because the plugin improperly controls code generation, the supplied input can be interpreted as executable PHP or otherwise cause unintended code execution. Once code execution is achieved, the attacker can enumerate WordPress configuration, extract database credentials, create administrator users, modify plugin or theme files, upload web shells, install persistence, exfiltrate data, or pivot to additional infrastructure reachable from the web server.

How to fix it

Remove or disable WP Query Console immediately on all WordPress installations. No fixed version is listed, so upgrading is not currently a reliable remediation path unless the vendor publishes a patched release after version 1.0. Because this is a development/debug-style plugin with dangerous capabilities, it should not be present on production WordPress sites. Restrict administrative access to WordPress, enforce file integrity monitoring, disable direct PHP execution in upload directories where possible, and review the site for signs of compromise after removal. If the plugin was exposed to the internet, rotate WordPress administrator passwords, database credentials, API keys, and any secrets stored in wp-config.php or plugin settings.

How to confirm the fix worked

Confirm the plugin is not installed or active by checking the WordPress admin plugin inventory, WP-CLI output, and the filesystem for the wp-query-console plugin directory. Validate that public HTTP requests to the plugin path return 404, 403, or otherwise cannot reach plugin code. Run an authenticated WordPress vulnerability scan to confirm WP Query Console version 1.0 or earlier is absent. Review file integrity against known-good backups or source control, especially wp-content/plugins, wp-content/themes, wp-content/uploads, and the WordPress root. Confirm no unexpected administrator users, scheduled tasks, modified PHP files, or suspicious outbound network connections remain.

Typical attack path

1. Scan public WordPress sites for evidence of the WP Query Console plugin.
2. Confirm the plugin version is affected, especially version 1.0 or earlier.
3. Send crafted HTTP requests to the vulnerable plugin functionality containing code-injection payloads.
4. Achieve arbitrary code execution under the web server or PHP runtime context.
5. Read WordPress configuration and database credentials.
6. Create persistence by adding an administrator account, modifying theme/plugin files, or placing a web shell.
7. Use the compromised site for data theft, malware delivery, spam, redirect campaigns, or further lateral movement.

How to detect it

Investigate whether the plugin was present and reachable during the exposure window. Review web server access logs, reverse proxy logs, CDN/WAF logs, and WordPress logs for requests referencing the WP Query Console plugin path or suspicious POST requests to WordPress endpoints containing PHP execution keywords, encoded payloads, command separators, or unusual query parameters. Correlate those requests with PHP error logs, web server error logs, and EDR telemetry showing unexpected file writes or web server child processes. Examine wp-content/plugins, wp-content/themes, wp-content/uploads, and the WordPress root for recently created or modified PHP files, especially files with obfuscation such as base64_decode, eval, gzinflate, str_rot13, shell_exec, system, passthru, or assert. Check the WordPress users table through administrative tooling for newly created administrator accounts, unexpected password resets, or unfamiliar email addresses. Review outbound network telemetry for connections from the web server to unfamiliar IPs shortly after suspicious inbound requests. Because weaponized exploitation is reported, treat any confirmed internet exposure as requiring forensic review.

• /wp-content/plugins/wp-query-console/
• wp-query-console
• GET /wp-content/plugins/wp-query-console/
• POST /wp-content/plugins/wp-query-console/
• /wp-admin/admin-ajax.php
• eval(
• base64_decode(
• gzinflate(
• shell_exec(
• passthru(
• system(
• assert(
• php_uname(
• /wp-content/uploads/*.php
• /wp-content/themes/*.php
• /wp-content/plugins/*.php

What your security team should do

• Immediately inventory all WordPress assets for WP Query Console and remove the plugin wherever found.
• Prioritize internet-facing WordPress sites because the vulnerability is unauthenticated, remotely exploitable, weaponized, and rated CVSS 10.0.
• If the plugin was installed, perform compromise assessment rather than assuming simple removal is sufficient.
• Review web server, WAF, PHP, WordPress, and EDR logs for suspicious requests, file modifications, new admin users, and unexpected child processes spawned by the web server.
• Rotate WordPress administrator passwords and secrets in wp-config.php for systems where exposure is confirmed or cannot be ruled out.
• Harden WordPress by disabling plugin/theme file editing, limiting admin access, enforcing MFA, and blocking PHP execution in upload directories.
• Add detection rules for requests referencing wp-query-console and for suspicious PHP payload patterns targeting WordPress plugin endpoints.