CVE-2026-14249

Name of the Vulnerable Software and Affected Versions Request a Quote versions prior to 2.5.6

Description The Request a Quote plugin for WordPress allows unauthenticated attackers to perform code injection. The issue occurs because the emd delete file() function derives a PHP function name from the attacker-controlled path parameter and invokes it dynamically. This is accessible via the emd delete file AJAX action, which is registered for wp ajax nopriv. Although a nonce is used for protection, it is printed into the public quote-form page, allowing attackers to bypass this check and invoke arbitrary zero-argument PHP functions, such as phpinfo(), which can expose sensitive server configurations and credentials.

Recommendations Update the plugin to a version newer than 2.5.5. As a temporary mitigation, restrict access to the emd delete file AJAX action.