CVE-2026-90988

Name of the Vulnerable Software and Affected Versions Request a Quote WordPress plugin versions prior to 2.5.7

Description An unauthenticated AJAX handler fails to perform an authorization check, which allows unauthenticated users to read contact records of quote-request submissions. This includes access to records that the site has not published.

Recommendations Update the plugin to version 2.5.7 or later.