CVE-2026-18143

Name of the Vulnerable Software and Affected Versions Request a Quote for WooCommerce versions prior to 2.9.3

Description An arbitrary file upload issue exists in the afrfq submit quote via popup() function. The popup upload handler fails to validate file extensions and MIME types, using the raw filename provided by the user as the destination for the move uploaded file() function. This allows unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled. The issue is triggered via the admin-ajax endpoint.

Recommendations Update Request a Quote for WooCommerce to version 2.9.3 or later. As a temporary mitigation, disable public quote rules that utilize the multi-page popup flow.