T4G0

An arbitrary file upload issue exists in the `send feedback()` function. The flaw stems from insufficient file type validation, as the system relies exclusively on the client-supplied Content-Type header without performing server-side content inspection or extension validation. Authenticated attackers with subscriber-level access or higher can upload executable files, potentially leading to remote code execution. Although files are typically deleted after email transmission, a race condition during SMTP execution can allow access to the file, and files remain on the server indefinitely if the `wp mail()` function fails.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can permanently delete any file managed by the plugin, empty the trash, move files between categories, and publish or unpublish arbitrary files.

An arbitrary file upload issue exists in the `afrfq submit quote via popup()` function. The popup upload handler fails to validate file extensions and MIME types, using the raw filename provided by the user as the destination for the `move uploaded file()` function. This allows unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled. The issue is triggered via the `admin-ajax` endpoint.

An authentication bypass exists due to JWT (JSON Web Token) forgery. The issue occurs in the `FirebasePhoneAuthHelper::verify id token()` function, which validates token claims such as `alg`, `kid`, `aud`, and `iss` but fails to perform cryptographic signature verification using `openssl verify()` or an equivalent method against Google's public key certificates. This allows unauthenticated attackers to use a self-generated RSA key pair to forge a Firebase Phone Auth JWT and impersonate any phone number, leading to unauthorized access to existing accounts or the creation of arbitrary new accounts.