CVE-2026-18143 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-18143 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-18143 is a critical arbitrary file upload flaw in the Request a Quote for WooCommerce WordPress plugin, affecting all versions up to and including 2.9.2. The bug is in the popup quote upload flow and can let an unauthenticated attacker upload executable files—including PHP—into a web-accessible temporary directory when a public quote rule with the multi-page popup flow is enabled.

For solo developers and small teams, this is a high-risk “drop-in shell” style issue: if the vulnerable feature is exposed, an attacker may be able to gain remote code execution on the WordPress host, pivot into the site, steal data, or use the server to attack other systems. There is no known exploitation in the wild and it is not in KEV, but the severity is still CRITICAL (CVSS 9.8), so treat it as an urgent patch-and-verify event.

Immediate Action

  • Upgrade immediately to the first fixed release: Request a Quote for WooCommerce > 2.9.2 (TODO: confirm vendor-fixed version from advisory).
  • Disable the public quote popup flow and any feature that allows anonymous file uploads until patched.
  • Restrict access to the temporary upload directory with web server rules so uploaded files cannot execute as PHP.
  • Review recent uploads in the RFQ temp directory for unexpected .php, .phtml, .phar, or double-extension files.
  • Rotate secrets if you find suspicious uploads or signs of compromise: WordPress salts, admin passwords, API keys, and database credentials.
  • Check the vendor advisory or changelog here: Vendor advisory / changelog.

Affected Versions

  • request-a-quote-for-woocommerce@<=2.9.2 vulnerable
  • request-a-quote-for-woocommerce@2.9.3+ safe (TODO: verify exact fixed version)

Resolution Guide

WordPress / PHP plugin update:

wp plugin update request-a-quote-for-woocommerce
wp plugin status request-a-quote-for-woocommerce

If you manage WordPress via Composer:

composer update vendor/request-a-quote-for-woocommerce
composer show vendor/request-a-quote-for-woocommerce

npm / yarn / pnpm are not typically used for this WordPress plugin, but if your deployment pipeline packages assets or mirrors plugin releases, pin the fixed artifact explicitly:

npm install <package-name>@<fixed-version>
yarn add <package-name>@<fixed-version>
pnpm add <package-name>@<fixed-version>

pip / pipx are not applicable to the plugin itself, but use them if your ops tooling includes scanners or deployment helpers:

pip install --upgrade <tool-name>
pipx upgrade <tool-name>

Maven / Gradle are not applicable to the plugin itself, but if your build or security pipeline consumes a WordPress artifact scanner, update the scanner dependency:

mvn versions:use-latest-releases
./gradlew dependencies --refresh-dependencies

Linux package managers are only relevant if your hosting image bundles the plugin or a scanner:

sudo apt update && sudo apt upgrade
sudo yum update

Docker image tags: rebuild and redeploy with a patched WordPress image; do not rely on a mutable “latest” tag.

docker pull <your-wordpress-image>:<fixed-tag>
docker run --rm <your-wordpress-image>:<fixed-tag> php -v

Hardening example: disable the vulnerable feature until you confirm the fix.

// Example: gate the public quote popup feature behind a hard-off flag
if (defined('DISABLE_RFQ_POPUP_UPLOADS') && DISABLE_RFQ_POPUP_UPLOADS) {
    return;
}

Web server hardening: block script execution in the RFQ temp upload directory.

# Apache
<Directory "/var/www/html/wp-content/uploads/rfq-temp">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx
location ~* /wp-content/uploads/rfq-temp/.*\.(php|phtml|phar)$ {
    deny all;
}

Minimal code fix pattern: validate extension and MIME type before moving the upload.

$allowed_ext = ['jpg','jpeg','png','pdf'];
$ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
$mime = mime_content_type($_FILES['file']['tmp_name']);

if (!in_array($ext, $allowed_ext, true)) {
    wp_die('Invalid file type');
}

if (!in_array($mime, ['image/jpeg','image/png','application/pdf'], true)) {
    wp_die('Invalid MIME type');
}

$dest = $upload_dir . '/' . basename($_FILES['file']['name']);
move_uploaded_file($_FILES['file']['tmp_name'], $dest);

Detection & Verification

Check the installed version:

wp plugin list --name=request-a-quote-for-woocommerce
grep -R "Version:" wp-content/plugins/request-a-quote-for-woocommerce/*.php

Look for suspicious uploads:

find wp-content/uploads -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" -o -name "*.*.php" \) -ls
grep -R "move_uploaded_file" wp-content/plugins/request-a-quote-for-woocommerce
grep -R "afrfq_submit_quote_via_popup" wp-content/plugins/request-a-quote-for-woocommerce

Use dependency and vulnerability scanners:

wp vuln status request-a-quote-for-woocommerce
composer audit

Verify the fix: confirm the plugin version is above the vulnerable range, then test that uploads reject executable files and that the temp directory cannot execute PHP.

curl -I https://example.com/wp-content/uploads/rfq-temp/test.php
php -r 'echo file_exists("wp-content/uploads/rfq-temp/test.php") ? "present\n" : "absent\n";'

Risk and Impact

If the vulnerable popup quote flow is enabled and reachable by the public, an attacker may upload a web shell or other executable payload without authentication. That can lead to full site compromise, data theft, spam or malware hosting, and lateral movement into the rest of your infrastructure. For small teams, the blast radius often includes the WordPress admin account, customer records, email systems, and any secrets stored on the same server.

Keep reading