Request a Quote for WooCommerce Plugin Arbitrary File Upload
The Request a Quote for WooCommerce plugin through version 2.9.2 allows unauthenticated attackers to upload arbitrary files via the quote submission endpoint. CVSS 9.8 critical, patched in version 2.9.3.
- Vendor
- Addify
- Product
- Request a Quote for WooCommerce
- CVSS
- 9.8
- EPSS (exploit probability)
- 2.1%
- Status
- patched
- Published
Is CVE-2026-18143 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-18143 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 2.1% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-18143 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-18143 is an arbitrary file upload vulnerability in the Request a Quote for WooCommerce plugin (by Addify) affecting all versions through 2.9.2. The flaw exists in the afrfq_submit_quote_via_popup() function, which handles file attachments in quote submission requests without enforcing authentication. An unauthenticated attacker can reach the endpoint directly and upload files of arbitrary type.
The vendor released version 2.9.3 to address the flaw. Site operators should update through the WordPress plugin dashboard or by downloading directly from the WooCommerce marketplace. Full technical details are in the NVD record.
