Code Injection Vulnerability in Request a Quote Plugin for WordPress

CVE-2026-14249

What is CVE-2026-14249?

The Request a Quote plugin for WordPress has a code injection vulnerability stemming from improper handling of user input in the emd_delete_file AJAX action. This vulnerability allows unauthenticated attackers to derive and invoke any zero-argument PHP function on the server by exploiting the dynamic function call mechanism. An attacker can manipulate the $_POST['path'] parameter, leading to the execution of potentially dangerous built-in PHP functions like phpinfo(). This not only exposes sensitive server configuration and credentials but also opens up avenues for executing detrimental commands on the affected server.

References