CVE-2026-90988: Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

Q: Who can exploit this issue?

Any unauthenticated user can exploit the affected AJAX handler. No WordPress account or other authorization is required.

Q: What information could be exposed?

An attacker can read contact records from quote-request submissions, including records that have not been published by the site.

Q: Which installations are affected?

Request a Quote versions through 2.5.6 are affected. The issue is in an unauthenticated AJAX handler, so sites using the plugin may be exposed without a logged-in user session.

Published Oct 2, 2026

Updated

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.

Affected Software

1 affected component

Request a Quote<=2.5.6

Event History

Oct 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can exploit the affected AJAX handler. No WordPress account or other authorization is required.

What information could be exposed?

An attacker can read contact records from quote-request submissions, including records that have not been published by the site.

Which installations are affected?

Request a Quote versions through 2.5.6 are affected. The issue is in an unauthenticated AJAX handler, so sites using the plugin may be exposed without a logged-in user session.

CVE-2026-90988: Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which installations are affected?