CVE-2026-18143

Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

Addify Request a Quote for WooCommerce

CVSS

9.8Critical

ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei

Exploit odds (EPSS)1.71%Chance of exploitation activity in the next 30 days, higher than 77% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Published26 Sep 2026Updated 26 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Public exploit code and templates 1

Scanner templateRequest Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File UploadNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfq_submit_quote_via_popup() function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for move_uploaded_file(). This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.

Text from CVE List

Affected versions 1

Request a Quote for WooCommerceaffected: all versions through 2.9.2CVE List