Cpe:2.3:a:wordpress:request_a_quote_for_woocommerce:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awordpressrequest_a_quote_for_woocommerce/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 26 Sep 2026 08:57:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary File Upload Vulnerability in Request a Quote for WooCommercehttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-18143/Sat, 26 Sep 2026 08:57:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-18143/The Request a Quote for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions 2.9.2 and below, allowing remote attackers to upload executable PHP files.The Request a Quote for WooCommerce plugin for WordPress is vulnerable to an arbitrary file upload flaw, assigned as CVE-2026-18143, affecting all versions up to and including 2.9.2. The vulnerability exists within the afrfq_submit_quote_via_popup() function, which fails to perform server-side validation on file extensions or MIME types during the file upload process. When a site has a public quote rule configured to use the multi-page popup flow, an unauthenticated attacker can supply a malicious PHP file through the request handler. The plugin uses the attacker-provided filename directly when calling move_uploaded_file(), writing the file to a web-accessible temporary directory. Successful exploitation allows an attacker to execute arbitrary code on the underlying web server, posing a critical threat to the integrity and confidentiality of the WordPress environment.

Impact

Successful exploitation of CVE-2026-18143 enables unauthenticated remote code execution on WordPress sites running the vulnerable plugin version. This grants attackers the ability to compromise site data, escalate privileges within the WordPress environment, or gain persistent access to the host server.

Recommendation

  • Upgrade the Request a Quote for WooCommerce plugin to the version containing the patch for CVE-2026-18143.
  • Implement a web application firewall (WAF) rule to block POST requests containing executable extensions (e.g., .php, .phtml) directed toward the plugin's quote upload endpoint.
  • Audit the temporary upload directory for unauthorized scripts if the plugin was previously exposed to the internet.
]]>criticaladvisorywordpressarbitrary-file-uploadremote-code-executioncve-2026-18143