PT-2026-54640 · Emarket Design · Request A Quote – Quote Forms For Any Wordpress Site

Mitchell · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-14249

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd delete file AJAX action. This is due to the emd delete file() handler deriving a PHP function name from the attacker-controlled $ POST['path'] parameter and invoking it dynamically via the variable-function call $sess name(), and the handler being registered for wp ajax nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp localize script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-14249

Affected Products

Request A Quote – Quote Forms For Any Wordpress Site

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-14249 · Security Note
• https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/class-install-deactivate.php#L60 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3592676%40request-a-quote&new=3592676%40request-a-quote&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5a349c4f-d2e7-47af-9013-3cfa496b3b8c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/emd-form-builder-lite/emd-form-frontend.php#L1187 · Note
• https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/common-functions.php#L1038 · Note
• https://plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/common-functions.php#L1035 · Note