Unauthorized Data Modification in Dealia – Request a Quote Plugin for WordPress

CVE-2026-2504

What is CVE-2026-2504?

The Dealia – Request a Quote plugin for WordPress has a vulnerability that allows authenticated attackers with Contributor-level access or higher to make unauthorized modifications to plugin settings. This is due to missing capability checks on various AJAX handlers. The admin nonce, which is supposed to provide security, is unnecessarily exposed to users with the edit_posts capability. Attackers can exploit this oversight to reset the plugin configuration, potentially leading to unauthorized changes in data settings and other critical operations.

References