CVE-2026-18143
published 2026-09-26CVE-2026-18143: The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the…
PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
1.71%
77.1th percentile
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| addify | request_a_quote_for_woocommerce | <= 2.9.2 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function.
ghsa_unreviewed·2026-09-26
CVE-2026-18143 [CRITICAL] CWE-434 The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function.
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
VulnCheck
Unrestricted Upload of File with Dangerous Type
vulncheck·2026·CVSS 9.8
CVE-2026-18143 [CRITICAL] Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are una
No detection rules found.
Nuclei
Request Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload
nuclei·CVSS 9.8
CVE-2026-18143 [CRITICAL] Request Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload
Request Quote for WooCommerce ]+value="([^"]+)"'
internal: true
- type: regex
name: qty_key
group: 1
regex:
- 'name="quote_qty\[([^\]]+)\]"'
internal: true
- type: regex
name: rfq_field1
group: 1
regex:
- '^[\s\S]*?name="(afrfq_field_\d+)"'
internal: true
- type: regex
name: rfq_field2
group: 1
regex:
- '^[\s\S]*?name="afrfq_field_\d+"[\s\S]*?name="(afrfq_field_\d+)"'
internal: true
- type: regex
name: rfq_field3
group: 1
regex:
- '^[\s\S]*?name="afrfq_field_\d+"[\s\S]*?name="afrfq_field_\d+"[\s\S]*?name="(afrfq_field_\d+)"'
internal: true
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary={{bound}}
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
--{{bound}}
Content-Disposition: form
No writeups or analysis indexed.
2026-09-26
Published
Exploited in the wild