CVE-2026-14249: Request a Quote WordPress Plugin Code Injection Vulnerability

Technical summary

CVE-2026-14249 is a code injection vulnerability in the Request a Quote WordPress plugin up to version 2.5.5. The emd_delete_file() AJAX action handler, registered via wp_ajax_nopriv, derives a PHP function name from the $_POST['path'] parameter and executes it through variable-function invocation ($sess_name()). The only protection is a nonce, which the plugin embeds into the public quote-form page via wp_localize_script, rendering it discoverable and reusable by unauthenticated attackers. The flaw permits execution of zero-argument PHP functions, potentially exposing sensitive server state or enabling destructive operations. This is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Business impact

Exploitation could lead to unauthorized disclosure of sensitive server configuration, database credentials, API keys, and other environment variables through function calls like phpinfo(). In a worst-case scenario, attackers could invoke destructive PHP functions to corrupt data, disrupt service availability, or establish persistence. For organizations relying on the Request a Quote plugin for lead generation or customer engagement, a compromise could damage customer trust, disrupt business processes, and trigger regulatory reporting obligations if customer data is exposed. The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and the significant integrity impact, though note that confidentiality impact is rated as none in the base vector—likely because the vector was conservative about the specific functions attackers might target.

Affected systems

The Request a Quote plugin for WordPress versions up to and including 2.5.5 are vulnerable. The vulnerability is exploitable only on installations where the plugin is active and the quote-form page (which serves the nonce) is publicly accessible. Self-hosted WordPress sites using this plugin are at risk; managed WordPress hosting providers may have additional protections. The lack of a vendor/product list in the ground-truth data suggests broad impact across all affected plugin versions with no particular third-party product dependency.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and no special network position (CVSS vector: AV:N/AC:L/PR:N/UI:N). An attacker only needs to visit the public quote-form page to obtain the nonce, then craft a POST request to the wp_admin/admin-ajax.php endpoint with the emd_delete_file action and a malicious path parameter containing a PHP function name. No special tools or deep technical skill are required; standard HTTP clients suffice. The nonce protection, intended as a CSRF defense, is ineffective here because it is not secret. Currently, the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, though this should not be interpreted as evidence that no exploit code exists in the wild.

Remediation

The immediate fix is to update the Request a Quote plugin to a version newer than 2.5.5 (verify the exact patched version against the vendor's advisory). Organizations unable to patch immediately should disable or remove the plugin if its functionality is not critical, or restrict access to the quote-form page via firewall rules, IP whitelisting, or authentication requirements. A defense-in-depth measure includes disabling dangerous PHP functions (e.g., phpinfo, passthru, system, exec) via php.ini directives, though this does not eliminate the underlying vulnerability.

Patch guidance

1. Access your WordPress admin dashboard. 2. Navigate to Plugins > Installed Plugins. 3. Locate Request a Quote and check the available version. 4. Click Update if prompted, or deactivate and remove the plugin if updates are unavailable. 5. Verify the updated version is newer than 2.5.5 by consulting the vendor's advisory. 6. After patching, review site access logs and server logs for suspicious AJAX requests to admin-ajax.php with the emd_delete_file action to detect potential prior exploitation. 7. If you cannot update immediately, consider disabling the plugin temporarily or moving the quote-form page behind authentication.

Detection guidance

Monitor web server and WordPress access logs for POST requests to /wp-admin/admin-ajax.php with the action parameter set to emd_delete_file and path parameters containing PHP function names (phpinfo, system, passthru, exec, eval, shell_exec, etc.). Implement WAF rules to block AJAX requests to this endpoint from unauthenticated users, or require the presence of a valid, time-limited session cookie. Review server access logs and application logs for execution of unexpected PHP functions or calls to phpinfo. Monitor file integrity and configuration changes on the server. A SIEM or log aggregation tool can help correlate multiple suspicious requests from the same IP address or user agent.

Why prioritize this

Deploy patches for this vulnerability within your next scheduled maintenance window, ideally within 7–14 days. The combination of zero-authentication requirement, trivial exploitability, and potential for sensitive data exposure or server compromise justifies high priority. Although the CVSS confidentiality score is rated as none, in practice, attackers can extract significant information. If the Request a Quote plugin is not business-critical or sees low traffic, consider deactivation as a faster interim measure while you coordinate a patch.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an exploitable attack vector (network-based, low complexity, no authentication needed) with significant integrity impact. The nonce check, while present, does not meaningfully reduce the attack surface because it is publicly disclosed. The score does not account for real-world scenarios where attackers may chain this with other techniques to escalate privileges or access restricted data, so organizations should consider the practical risk to be at least as high as the base score suggests.

Frequently asked questions