CVE-2026-18143: WooCommerce File Upload Flaw
TL;DR
- CVE-2026-18143 is a CVSS 9.8 arbitrary-file-upload vulnerability in Request a Quote for WooCommerce through version 2.9.2.
- Unauthenticated attackers may upload executable files when the public multi-page popup quote flow is enabled.
- No confirmed exploitation or public proof of concept was identified in the available research.
- Disable the affected workflow or plugin, block script execution in upload directories, and verify a vendor-fixed release before re-enabling the feature.
Summary
CVE-2026-18143 is a critical WordPress file upload vulnerability affecting the Request a Quote for WooCommerce plugin through version 2.9.2. NVD describes an unauthenticated arbitrary-file-upload flaw in the afrfq_submit_quote_via_popup() function. The vulnerable handler reportedly lacks sufficient file-extension and MIME-type validation and uses an attacker-supplied filename with PHP’s move_uploaded_file() function.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-18143 |
| CVSS base score | 9.8 Critical |
| Affected product | Request a Quote for WooCommerce |
| Affected versions | All versions up to and including 2.9.2 |
| Attack vector | Network |
| Authentication required | None |
| User interaction | None described |
| Patch available | No fixed version was verified in the supplied sources |
| CISA KEV | Not listed in the supplied assessment |
The practical impact depends on the site’s configuration. An attacker must be able to reach the relevant public quote workflow, and the multi-page popup flow must be enabled under a public quote rule. If the resulting temporary RFQ upload directory is web-accessible and permits PHP or other server-side script execution, the upload may lead to remote code execution and potentially complete WordPress or server compromise.
Administrators should not assume that version 2.9.2 is safe because a fixed release was not verified. Version 2.9.2 and every earlier version are within the stated affected range. Until the publisher or distribution channel identifies a release that explicitly fixes this CVE, disable the affected functionality or remove the plugin.
Analyst’s take: Treat CVE-2026-18143 as a containment problem first, not merely a version-checking exercise. The available research does not confirm a fixed release, while the vulnerable workflow can accept unauthenticated uploads and may expose them to server-side execution.
Root Cause
The vulnerable code path accepts an uploaded file through the popup quote submission handler. The available vulnerability description identifies two related validation failures:
- Insufficient file-extension validation
- Insufficient MIME-type validation
Client-supplied MIME types are not a reliable security boundary. Extension checks must also account for alternate PHP extensions, case variations, double extensions, and server-specific handler mappings.
The handler reportedly passes the raw attacker-controlled filename to move_uploaded_file(). This creates a dangerous combination:
- An unauthenticated request can reach the upload handler.
- The application does not adequately restrict the uploaded file type.
- The attacker can influence the destination filename.
- The file may be placed in a temporary RFQ directory reachable over HTTP.
- The web server may execute the uploaded file as PHP or another server-side script.
A request containing a PHP script could therefore create an executable server-side file rather than a harmless document.
Technical Notes
The relevant function identified in the vulnerability description is:
afrfq_submit_quote_via_popup()
The unsafe behavior can be summarized as:
unauthenticated request
-> popup quote upload handler
-> attacker-controlled filename
-> insufficient extension and MIME validation
-> move_uploaded_file()
-> web-accessible temporary RFQ directory
-> possible execution of uploaded server-side script
This vulnerability is not automatically equivalent to remote code execution on every installation. Execution requires the destination directory to be accessible and configured to execute PHP or another server-side language. A hardened web server that treats upload directories as static content may prevent direct code execution, but the arbitrary-file-upload issue remains serious.
For broader application security context, review the guidance on container escape vulnerabilities when assessing isolation between WordPress, PHP workers, and the underlying host.
Who Is Exposed?
The affected product is Request a Quote for WooCommerce, a WordPress and WooCommerce extension distributed through the official WooCommerce marketplace and associated with Addify.
The stated affected range is all versions up to and including 2.9.2. Installations running 2.9.2, 2.9.1, or earlier should be treated as vulnerable unless the administrator has independently confirmed a vendor security fix or removed the vulnerable code path.
Exposure is conditional on application configuration. Relevant conditions include:
- A public quote rule
- The multi-page popup quote flow being enabled
- A publicly reachable quote form
- An upload destination that is accessible over HTTP
- A web server that permits script execution in that destination
Sites that do not expose the quote form publicly may have a smaller attack surface, but configuration alone is not a permanent fix. Public endpoints can be re-enabled during site changes, and attackers may target alternate routes or overlooked forms.
Prioritize internet-facing WordPress sites using this plugin, especially stores that permit anonymous visitors to submit quote requests and upload supporting documents. Managed WordPress environments, staging systems connected to production data, and sites where the web process can write to executable directories deserve the same review.
Technical Notes
Use WP-CLI to identify the installed plugin and version before taking action. The plugin slug must be confirmed from the local installation because the supplied research does not establish an authoritative CLI slug:
wp plugin list --fields=name,status,version,update --format=table
Review the plugin directory and configuration for the public quote workflow. Do not assume that an apparently inactive form is disabled if a public quote rule or popup shortcode remains deployed. Check the plugin’s administrative settings, page templates, cache, and CDN configuration.
Severity Breakdown
NVD assigns CVE-2026-18143 a CVSS base score of 9.8, placing it in the Critical category. The described characteristics support a network-reachable, unauthenticated attack with no required user interaction and potentially high confidentiality, integrity, and availability impact.
| CVSS characteristic | Assessment |
|---|---|
| Attack vector | Network |
| Attack complexity | Described as low or otherwise consistent with a critical remote profile |
| Privileges required | None |
| User interaction | None |
| Confidentiality impact | Potentially high if code execution or site access follows |
| Integrity impact | Potentially high if attackers modify WordPress or server content |
| Availability impact | Potentially high through site destruction, malware deployment, or service disruption |
| Exact CVSS vector | Not present in the supplied NVD result; verify directly in NVD |
The exact CVSS vector string was not available in the retrieved record. The component interpretation above reflects the supplied vulnerability characteristics and should not be used to reconstruct an unverified vector. Defenders should use 9.8 for prioritization while checking the NVD record for any later vector, severity, or vendor correction.
CVSS does not account for every environmental factor. A site with non-executable upload directories and strict web-server isolation may have a lower practical likelihood of code execution. Conversely, a shared hosting account with writable web roots may face substantially greater consequences.
Exploitation Status
CVE-2026-18143 was not listed in the CISA Known Exploited Vulnerabilities catalog at the time of the supplied assessment. No confirmed in-the-wild exploitation was identified in the sources checked. This means there is no CISA KEV confirmation available; it does not prove that exploitation can be ruled out.
No verified public proof-of-concept repository or authoritative exploit demonstration was identified in the collected research. Generic vulnerability lists, unrelated 2026 exploit references, or search results mentioning other WordPress issues should not be treated as evidence of a CVE-2026-18143 exploit.
The technical risk remains high despite the lack of confirmed exploitation. Unauthenticated file-upload vulnerabilities are attractive to automated scanning, and exploitation may leave limited application-level evidence if an attacker uploads a short-lived script. Monitor for suspicious files and requests now rather than waiting for a KEV listing or public proof of concept.
Sources
The primary technical reference is the NVD record:
The NVD-provided product reference identifies the affected WooCommerce extension and marketplace listing:
The vulnerability intelligence reference supplied for this assessment is:
The available research confirms the affected range through 2.9.2 and the CVSS 9.8 rating, but it does not confirm a fixed version, public proof of concept, or active exploitation. CISA KEV status was reported as not listed. Recheck the NVD record, the official product distribution channel, and CISA KEV before closing the incident or marking the plugin as remediated.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine web-server logs, WordPress activity, filesystem inspection, and post-compromise review. Focus on:
- Unauthenticated requests to the public quote workflow
- Upload requests that return successful responses
- Newly created executable files in the plugin’s temporary RFQ directory
- Requests for newly uploaded
.php,.phtml,.php5, or.pharfiles - WordPress, administrator, or hosting changes that follow suspicious uploads
Because the precise endpoint path is configuration-dependent and was not supplied, identify the active form action and log it rather than relying on a guessed URL.
A successful upload may not produce a distinctive status code. An attacker can submit a request that returns a normal application response and then invoke the uploaded file in a separate request. Investigate sequences involving a quote submission followed by a request for a newly created executable file from the same source IP or user agent.
Log Searches
A basic Apache or Nginx access-log search can identify likely follow-on requests. Adjust the log path and date range for the environment:
zgrep -Ei \
'/(wp-content/uploads|wp-content/plugins|uploads|tmp)/[^ ]+\.(php|phtml|php[0-9]|phar)(\?|[[:space:]])' \
/var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null
An Elastic-style query for suspicious requests may look like this:
url.path : ("/wp-content/uploads/*" or "/uploads/*" or "/tmp/*")
and url.path : (*.php or *.phtml or *.php5 or *.phar)
and http.request.method : GET
Search for POST requests to the active quote endpoint with multipart content, especially when followed by a request for an executable file from the same source IP or user agent:
http.request.method:POST
and http.request.mime_type:"multipart/form-data"
and (url.path:*quote* or url.path:*rfq* or url.path:*ajax*)
Filesystem Review
Review recently created executable files:
find /var/www -type f \
\( -iname '*.php' -o -iname '*.phtml' -o -iname '*.php5' -o -iname '*.phar' \) \
-mtime -14 -printf '%TY-%Tm-%Td %TH:%TM %u %p\n' 2>/dev/null
Replace /var/www with the actual WordPress document root. Treat unexpected executable files in upload or temporary directories as potential compromise evidence, preserve them for analysis, and do not execute them.
Remediation Steps
The affected range is through and including version 2.9.2. The supplied sources do not identify a confirmed fixed version. Check the official WooCommerce or Addify distribution channel for a release that explicitly states it fixes CVE-2026-18143. Do not invent or assume a fixed version number based only on a newer-looking release.
If a fixed version is published, record the current state and back up the site, database, and configuration. Then update through the normal WordPress administration interface or the verified WP-CLI plugin slug:
wp plugin list --fields=name,version,status
wp plugin update <verified-plugin-slug>
wp plugin list --fields=name,version,status
If no fixed release is available:
- Disable the affected plugin, or at minimum disable the public multi-page popup quote workflow.
- Disable every public quote rule that can reach the vulnerable handler.
- Block script execution in upload and temporary RFQ directories.
- Review web, WordPress, and filesystem logs.
- Inspect for previously uploaded backdoors or other unexpected changes.
The emergency deactivation command is:
wp plugin deactivate <verified-plugin-slug>
Replace the placeholder with the plugin directory name shown by wp plugin list. The supplied research does not establish that slug. Removing or disabling the plugin is preferable to relying only on an obscure configuration setting.
Block Script Execution
As an additional control, prevent script execution in WordPress upload and RFQ temporary directories.
For Apache, place an appropriate rule in the relevant directory configuration or .htaccess, subject to the hosting provider’s policy:
<FilesMatch "\.(php|phtml|php[0-9]|phar)$">
Require all denied
</FilesMatch>
For Nginx, ensure requests for executable extensions under the upload path are denied before reaching the PHP handler:
location ~* ^/REPLACE_WITH_UPLOAD_PATH/.*\.(php|phtml|php[0-9]|phar)$ {
deny all;
return 403;
}
Replace the path with the actual public upload or temporary RFQ path. Test the rule in staging and confirm that normal document downloads still work. Inspect existing files before and after applying the rule because a web-server restriction prevents execution but does not remove an already uploaded backdoor.
Post-Containment Review
After containment, review:
- WordPress administrator accounts
- Plugins and themes
- Scheduled tasks and cron jobs
- Database options
- Web-server configuration
- Recently modified files
- Hosting, SSH, database, and API access logs
Rotate WordPress, hosting, database, SSH, and API credentials if suspicious activity is found. A password manager such as 1Password can help teams generate and store unique replacement credentials, but credential rotation should be coordinated with incident-response procedures.
If executable files or unexpected administrative changes are confirmed, handle the event as a potential compromise rather than a routine plugin update. Preserve evidence and involve qualified incident responders where necessary.