Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-18143: Request a Quote for WooCommerce allows anyone to upload files
CVE-2026-18143 · published 23 days ago
Summary
The Request a Quote for WooCommerce plugin for WordPress (versions up to 2.9.2) lets people who are not logged in upload files through a popup form. Because the upload handler does not check the file type, an attacker could place executable code on your site, potentially taking control of it. Update the plugin to a newer version or disable the public quote popup until the fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| addify | request a quote for woocommerce | <= 2.9.2 |
Original advisory text
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-434Unrestricted File Upload
Timeline
Published26 Sep 2026
Updated16 Oct 2026
First seen26 Sep 2026
Track software like this
Free during beta