CVE-2026-18143: Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup() function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for moveuploadedfile(). This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Sites using affected versions of the plugin are exposed when a public quote rule is enabled with the multi-page popup flow. The vulnerable upload handler can then be reached without authentication.
What does an attacker need to exploit this issue?
An attacker needs network access to the site and access to the public quote popup flow. No account, privileges, or user interaction are required.
What is the likely impact of a successful upload?
An attacker can upload executable files, including PHP files, into a web-accessible temporary RFQ upload directory. This can lead to compromise of confidentiality, integrity, and availability.