EUVD-2026-91189
GHSA-24j4-6qf8-p4rw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Request a Quote plugin
-
ExploitSend crafted request to unauthenticated AJAX handler
-
ExecutionAuthorization check absent, records returned
-
ImpactHarvest unpublished contact/PII records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against any site running the Request a Quote WordPress plugin version 2.5.6 or earlier, because one of its AJAX handlers is registered for unauthenticated access (the wp_ajax_nopriv path) and omits the authorization check - no login, nonce, capability, or user interaction is required. The only real prerequisites are that the plugin is installed and active and that quote-request contact records exist to be read. The limiting factor is scope: the flaw exposes only this plugin's quote-submission contact data (confidentiality), not site takeover, write access, or availability, and sites not running this specific plugin are unaffected. |
| Impact | This is a moderate-risk, unauthenticated information-disclosure flaw (CWE-200). The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) is internally consistent with the description: a missing authorization check on an unauthenticated AJAX handler lets any remote actor read quote-request contact records, including unpublished ones, with no authentication or user interaction. The low complexity and network vector make exploitation trivial, but impact is bounded - confidentiality-only (C:L), with no integrity or availability effect. No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no signal of active exploitation or weaponized code; exploitation probability cannot be quantified from the data given. The practical concern is exposure of PII (names, contact details, possibly messages) from quote submissions, which carries privacy/compliance implications rather than system compromise. Net assessment: a genuine but mid-tier issue - easy to exploit and reach remotely, yet limited to data leakage of one plugin's records, so it is a priority for sites running this plugin but not a critical infrastructure-level emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker discovers a WordPress site running Request a Quote ≤2.5.6 and directly invokes the vulnerable admin-ajax handler without logging in. The handler skips authorization, returning stored quote-request contact records - including submissions the site owner never published - leaking customer PII. No public exploit was identified in the provided data, but the attack requires only crafted HTTP requests given AV:N/AC:L/PR:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Unauthenticated information disclosure in the Request a Quote WordPress plugin (versions through 2.5.6) lets any remote attacker retrieve the contact details stored for quote-request submissions - including entries the site owner has not published - by calling an AJAX handler that is exposed to logged-out visitors without any authorization check. No authentication, nonce, capability, or user interaction is required, and the impact is limited to confidentiality of this plugin's stored quote data (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); there is no write access, privilege escalation, or availability impact. No public exploit identified at time of analysis and no confirmed active exploitation.
RemediationAI
No vendor-released patch version is identified in the supplied data - the advisory only establishes that all versions through 2.5.6 are vulnerable - so remediation guidance is advisory-based rather than pinned to a fixed version number; check the vendor/WPScan advisory (https://wpscan.com/vulnerability/6c02759e-b37e-43ce-a4f4-467e8af63a17/) for a release later than 2.5.6 and update as soon as one is published, then confirm the AJAX handler now enforces a capability or nonce check. If no fixed version is available or immediate updating is not possible, the most effective compensating control is to deactivate and remove the plugin if the quote-request feature is not business-critical - the trade-off is loss of the quote form and stored lead data. Where the feature must stay online, block or challenge requests to /wp-admin/admin-ajax.php that carry the plugin's quote-record-reading action (via a WAF/reverse-proxy rule or a small mu-plugin that unregisters the wp_ajax_nopriv handler) - accepting that legitimate logged-out visitors submitting quotes may be affected depending on which action is blocked, so test against the pre-fix handler list first. Because the exposed records are contact details from quote submissions, reduce blast radius by minimizing retained contact fields and by treating all previously submitted quote data as potentially disclosed. Monitor web logs for unauthenticated admin-ajax.php POSTs referencing the plugin's quote actions to detect enumeration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a missing-authorization-check defect (CWE-200, exposure of sensitive information to an unauthorized actor) in the WordPress plugin 'Request a Quote'. WordPress exposes AJAX endpoints through admin-ajax.php, dispatching to handlers registered with the wp_ajax_{action} hook for authenticated users and wp_ajax_nopriv_{action} for unauthenticated visitors. The affected handler is registered on the nopriv path - meaning it is intentionally reachable by logged-out users - but omits the capability check (and any nonce or authorization validation) that should gate access to quote-request contact records, so the handler returns stored submission data to anyone who can reach the endpoint. WordPress itself does not apply an implicit authorization layer to nopriv handlers, so the missing check is entirely the plugin's responsibility. The EUVD entry lists the affected range as 'Request a Quote 0 ≤2.5.6'; no CPE identifiers were supplied in the provided intelligence, so product and version scoping rests on that EUVD range and the WPScan advisory. Because the handler only reads plugin-owned quote records, the confidentiality impact is rated Low (C:L) with no integrity or availability effect.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated AJAX handler with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is limited PII disclosure only, so C:L and I:N/A:N.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB