PT-2025-32081 · WordPress · Request A Quote Form

Michael Mazzolini + 1 · Published 2025-08-06 · Updated 2025-08-11 · CVE-2025-8420

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Request a Quote Form plugin for WordPress versions prior to 2.5.3

Description The Request a Quote Form plugin for WordPress is susceptible to Remote Code Execution due to improper validation of user input before it is used as a function name within the emd form builder lite pagenum function. This allows unauthenticated attackers to execute code on the server, although parameters cannot be passed to the called functions.

Recommendations Update the Request a Quote Form plugin to version 2.5.3 or later.

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2025-8420

Affected Products

Request A Quote Form

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-8420 · Security Note
• https://plugins.trac.wordpress.org/changeset/3347084 · Note
• https://twitter.com/cracbot/status/1954860402413564352 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365190%40youtube-showcase&new=3365190%40youtube-showcase&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3348220%40wp-easy-events&new=3348220%40wp-easy-events&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset/3346435 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340992%40software-issue-manager&new=3340992%40software-issue-manager&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset/3346460 · Note
• https://twitter.com/VulmonFeeds/status/1952942846522060811 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3341064%40wp-ticket&new=3341064%40wp-ticket&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338854%40request-a-quote&new=3338854%40request-a-quote&sfp_email=&sfph_mail= · Note