Arbitrary File Upload Vulnerability in Request a Quote for WooCommerce Plugin by WordPress

CVE-2026-18143

What is CVE-2026-18143?

The Request a Quote for WooCommerce plugin is susceptible to an Arbitrary File Upload vulnerability in all versions up to and including 2.9.2. This vulnerability arises from inadequate validation of file extensions and MIME types in the upload handler associated with the afrfq_submit_quote_via_popup() function. As a result, unauthenticated attackers can exploit this flaw to upload malicious files, such as PHP scripts, to a publicly accessible temporary directory. This situation becomes especially critical when a public quote rule utilizing the multi-page popup flow is active, allowing attackers to execute harmful code on the host server.

References