CVE-2026-14249— Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
Possible ATT&CK Techniques 3AI
T1005 · Data from Local System T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14249
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| emarket-design | Request a Quote – Quote Forms for Any WordPress Site | 0 ~ 2.5.5 | - |
II. Public POCs for CVE-2026-14249
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14249
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-14249 (1)
Other References for CVE-2026-14249 (1)
IV. Related Vulnerabilities
Same vendor: emarket-design
- CVE-2026-12923
Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitra - CVE-2026-9848
WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordP - CVE-2025-15636
WordPress YouTube Showcase plugin <= 3.5.1 - Cross Site Scri - CVE-2025-64248
WordPress Request a Quote plugin <= 2.5.3 - Broken Access Co - CVE-2025-13403
Employee Spotlight – Team Member Showcase & Meet the Team Pl
Same weakness: CWE-74
- CVE-2026-57522
Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templ - CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with - CVE-2026-12888
HTML injection in the Canarytoken Google Chat notification - CVE-2026-50107
NGINX Gateway Fabric vulnerability - CVE-2026-20220
Cisco Crosswork Network Controller Remote Code Execution Vul
V. Comments for CVE-2026-14249
No comments yet