CVE-2024-50498: WP Query Console plugin code injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable code injection with a 9.8 CVSS score and public exploit code makes this an urgent patch-or-remove case.

What it is

The WordPress plugin WP Query Console (versions up to and including 1.0) fails to properly control code generation, allowing code injection. Because the flaw is reachable over the network without authentication, it exposes any site running the vulnerable plugin to full compromise.

Impact

An unauthenticated attacker can inject and execute arbitrary code on the WordPress host, gaining full control of the site and potentially the underlying server.

Attack surface

Reachable over the network via the plugin's exposed functionality; the CVSS vector shows no privileges or user interaction required (PR:N, UI:N). No further detail on the exact endpoint is given in the record.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.529, ~98.9th percentile) and a public GitHub repository titled '0-click-RCE-Exploit-for-CVE-2024-50498' exists, indicating public exploit code is available.

What to do

• Update WP Query Console to a version above 1.0 if one is released; if no fixed version exists, remove or deactivate the plugin immediately.
• Remove the plugin from any internet-facing WordPress installation until a patch is confirmed.
• Add WAF rules to block requests targeting the plugin's endpoints and suspicious code-like parameters.
• Audit the site for signs of compromise and rotate WordPress admin and database credentials if exploitation is suspected.
• Restrict access to wp-admin and plugin files where operationally feasible.

Detection

• Monitor web server logs for requests to wp-query-console plugin paths, especially with unusual or encoded parameters.
• Look for unexpected PHP file creation or modification in the WordPress uploads and plugin directories.
• Alert on outbound network connections or new processes spawned by the web server user.
• Review WordPress audit logs for unexpected administrative or plugin-related activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.