EUVD-2026-87542
GHSA-f78j-xwc8-gq3q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote upload of executable PHP with no validation yields code execution (C/I/A:H); AC:L since exploitation is trivial once the popup flow config prerequisite is met.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfq_submit_quote_via_popup() function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for move_uploaded_file(). This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
Articles & Coverage 2
AnalysisAI
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the plugin to be configured with a public (unauthenticated-accessible) quote rule AND the multi-page popup upload flow enabled - this specific feature exposes the vulnerable afrfq_submit_quote_via_popup() handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue, not merely a high-CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data at time of analysis, so the primary action is to check the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/3417ec27-6abf-45c7-945f-6ef456ba1187?source=cve) and the vendor product page (https://woocommerce.com/products/request-a-quote-plugin-for-woocommerce/) for an updated release and apply it as soon as one is published; if a fixed build above 2.9.2 becomes available, upgrade to it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress/WooCommerce instance running the Addify Request a Quote plugin at version 2.9.2 or below and identify any that combine an unauthenticated (publicly reachable) quote rule with the multi-page popup quote flow enabled; on those instances immediately disable the popup quote flow and the public quote rule, or deactivate the plugin entirely if the business can tolerate the interruption, and block execution of PHP and other script extensions inside the plugin's RFQ temporary upload directory at the Apache/nginx layer. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today