CVE-2026-18143 — Addify Request a Quote for WooCommerce Unauthenticated File Upload

Overview

CVE-2026-18143 affects Request a Quote for WooCommerce (woocommerce-request-a-quote, Addify / WooCommerce.com). Public research describes unauthenticated arbitrary file upload via afrfq_submit_quote_via_popup(): the handler uses move_uploaded_file() with the raw client filename, without extension or MIME allowlisting, writing into a web-accessible temporary RFQ upload directory. Attackers can upload .php webshells when a public quote rule uses the multi-page popup flow. Fixed in versions > 2.9.2.

| | | |---|---| | Product | Request a Quote for WooCommerce (Addify) | | Plugin path | wp-content/plugins/woocommerce-request-a-quote/ | | Affected | ≤ 2.9.2 | | AJAX | action=afrfq_submit_quote_via_popup → admin-ajax.php | | Prerequisite | Popup quote rule enabled on storefront |

Open source PoC: https://github.com/murrez/CVE-2026-18143

Attack prerequisites

1. WordPress + WooCommerce with the Addify RFQ plugin at a vulnerable version (≤ 2.9.2).
2. A public quote configuration that exposes the popup multi-step flow (nonce often in localized afrfq JS on shop/product pages).
3. Upload directory reachable over HTTP if verification or exploitation is attempted.

Bundled tool (Python 3)

Member download matches the GitHub repository (poc.py):

• check — Plugin/version fingerprint, AJAX handler probe, frontend nonce/popup hints; optional --upload-probe writes a marker PHP and verifies HTTP retrieval (authorized targets only).
• exploit — Upload chain with --nonce (or auto-scrape) and optional --verify.
• Mass check — --list targets.txt -j N for inventories you own or have written scope for.

pip install -r requirements.txt
python poc.py -u https://shop.example --mode check
python poc.py -u https://shop.example --mode check --upload-probe
python poc.py -u https://shop.example --mode exploit --nonce YOUR_NONCE --verify
python poc.py --list targets.example.txt --mode check -j 15

Asset discovery (FOFA)

body="/wp-content/plugins/woocommerce-request-a-quote/"
body="afrfq"

Impact

Successful upload of executable content under the web root implies full application compromise (RCE as the web user), with typical follow-on risk to customer data and adjacent WordPress plugins.

Remediation

1. Upgrade Request a Quote for WooCommerce to a release > 2.9.2 from the vendor.
2. Until patched, restrict admin-ajax.php and RFQ upload paths where feasible; review quote rules and disable unused popup flows.
3. Hunt for unexpected .php under .../woocommerce-request-a-quote/uploads/ and rotate credentials if compromise is suspected.

Legal and ethical use

--upload-probe and --mode exploit write files to the target. Use only on systems you own or have explicit written permission to test.

References

• NVD — CVE-2026-18143
• GitHub PoC — murrez/CVE-2026-18143