PT-2026-20642 · WordPress · Dealia – Request A Quote

Ronnachai Sretawat Na Ayutaya + 1 · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-2504

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dealia – Request a quote plugin for WordPress versions through 1.0.6

Description The Dealia – Request a quote plugin for WordPress is susceptible to unauthorized data modification. This is due to insufficient capability checks within multiple AJAX handlers. The DEALIA ADMIN NONCE is exposed to users with edit posts capability (Contributor+) through wp localize script() in PostsController.php. Additionally, AJAX handlers in AdminSettingsController.php only validate the nonce without verifying if the current user has 'manage options' capability. This allows authenticated attackers with Contributor-level access or higher to reset the plugin configuration.

Recommendations Update to a version beyond 1.0.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2504

Affected Products

Dealia – Request A Quote

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-2504 · Security Note
• https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/AdminSettingsController.php#L243 · Note
• https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/PostsController.php#L49 · Note
• https://t.me/CVEtracker/45075 · Telegram Post
• https://twitter.com/CVEnew/status/2024501269835215169 · Twitter Post
• https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L243 · Note
• https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L416 · Note
• https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/PostsController.php#L49 · Note
• https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L309 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c8f506ef-972c-403d-9167-ffdd93be8ea6?source=cve · Note