Description

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-26T07:17:02.017Z",
  "pubdate": "2026-09-26T07:17:02.017Z",
  "executiveSummary": "The Request a Quote for WooCommerce plugin for WordPress contains a critical Arbitrary File Upload vulnerability within the afrfq_submit_quote_via_popup() function.\nThis vulnerability exists in all versions up to and including 2.9.2.\nThe flaw allows unauthenticated remote attackers to upload arbitrary files, including malicious PHP scripts, directly to the web server.\nSuccessful exploitation leads to Remote Code Execution (RCE), enabling attackers to compromise the integrity, confidentiality, and availability of the WordPress installation.\nThe vulnerability is triggered when a public quote rule with a multi-page popup flow is enabled, exposing the upload handler to public requests without session or authorization checks.\nGiven that the uploaded files are stored in a web-accessible directory, attackers can trigger execution by directly requesting the file path via HTTP.\nThis poses a severe risk, as it grants unauthorized entities the ability to execute system commands, access sensitive database information, or pivot within the hosting environment.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and sanitization within the afrfq_submit_quote_via_popup() function of the Request a Quote for WooCommerce plugin.\nThe application fails to perform any verification of file extensions or MIME types for files processed through the popup upload handler.\nThe backend utilizes the raw, user-controlled filename provided in the request as the destination for the move_uploaded_file() function, allowing an attacker to manipulate the target file path and extension.\nWhen a public quote rule is active with the multi-page popup flow enabled, the vulnerable function is exposed to unauthenticated users via the WordPress AJAX or frontend request handler.\nThe attack flow begins with the attacker crafting an HTTP POST request containing a malicious payload, such as a web shell with a .php extension, targeting the endpoint responsible for the RFQ popup upload.\nBecause the server lacks logic to verify the file signature or enforce an allow-list of extensions, the move_uploaded_file() function successfully writes the attacker-supplied file into a predictable, web-accessible temporary directory designated for RFQ uploads.\nOnce the file is successfully persisted on the filesystem, the attacker can execute arbitrary code by sending a standard GET request to the path where the file was moved.\nThis execution context typically runs with the privileges of the web server process (e.g., www-data), granting the attacker the ability to interact with the WordPress filesystem, configuration files, and the underlying database.\nAffected versions include all iterations through 2.9.2. There are no authentication or privilege requirements for exploitation, as the endpoint is exposed by the default configuration of the plugin's public-facing quote flow.\nThis vulnerability represents a significant security oversight in the handling of user-supplied binary data, facilitating complete site takeover if the uploaded shell is used to deploy persistent backdoors or modify core plugin/theme files."
}