// vulnerability record
cached · NVD via COSMOS syncCVE-2026-14249
HIGHpublished 2026-07-02 06:16 UTC · 2 days ago · modified 2026-07-02 15:16 UTC
// description
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.
// weaknesses (CWE)
- CWE-74
// references (6)
- https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/class-install-deactivate.php#L60
- https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/common-functions.php#L1035
- https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/common-functions.php#L1038
- https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/emd-form-builder-lite/emd-form-frontend.php#L1187