Critical File Upload Bug in WooCommerce Quote Plugin

The afrfq_submit_quote_via_popup() function in the Request a Quote for WooCommerce plugin accepts file attachments without verifying that the requester is logged in. Any unauthenticated visitor can reach that endpoint and upload an arbitrary file, including executable types. The flaw is tracked as CVE-2026-18143 and carries a CVSS score of 9.8. It affects every version of the plugin through 2.9.2.

WooCommerce is the foundation for a large share of public-facing e-commerce stores. Plugins that add quoting workflows are common in B2B and wholesale configurations, where customers request pricing before placing an order. Because the vulnerable endpoint requires no authentication, the attack surface extends to any visitor: no account, no session, no precondition beyond reaching the endpoint.

No confirmed exploitation in the wild has been reported as of publication. The National Vulnerability Database entry does not carry a CISA KEV designation at this time.

What to do: Addify released version 2.9.3 to address the flaw. Site operators running WooCommerce should check the installed version of the Request a Quote plugin and update immediately through the WordPress plugin dashboard. The NVD entry for CVE-2026-18143 contains the full technical record, and the plugin’s WooCommerce marketplace page links to the patched release.

Recent WordPress security coverage: an Elementor CSRF flaw disclosed last week allowed unauthenticated attackers to create rogue administrator accounts after tricking an admin into clicking a crafted link. A CVSS 10.0 payment plugin flaw patched in September granted full admin access without authentication. WordPress operators managing plugin inventory should treat unauthenticated critical flaws as immediate-patch items regardless of KEV status.