Junglewise Threat Intelligence

CVE-2026-14249: WordPress Request a Quote code injection in emd_delete_file

CVE-2026-14249 · Severity: high · CVSS 7.5 · Published 2026-07-02

Executive brief

The Request a Quote plugin for WordPress, which allows businesses to accept quote requests from customers, contains a security flaw that allows unauthorized users to run commands on the website's server. By exploiting this vulnerability, an attacker could potentially view sensitive server configuration details or delete files, leading to data exposure or service disruption. This issue affects all versions of the plugin up to 2.5.5.

Technical details

The Request a Quote plugin for WordPress is vulnerable to code injection due to the insecure use of dynamic function calls in the emd_delete_file() AJAX handler. The handler derives a PHP function name directly from the attacker-controlled $_POST['path'] parameter and executes it via a variable-function call ($sess_name()). Because the handler is registered via wp_ajax_nopriv and the required security nonce is publicly accessible in the page source via wp_localize_script, unauthenticated attackers can exploit this to invoke arbitrary zero-argument PHP functions. This can be used to execute functions like phpinfo() to leak system configuration or other built-in PHP functions to modify the server environment. A patch is available in versions following 2.5.5.

Affected products

  • emarket-design Request a Quote – Quote Forms for Any WordPress Site up to, and including, 2.5.5

Timeline

  • 2026-07-02: disclosed: Vulnerability disclosed by Wordfence
  • 2026-07-02: advisory: NVD published CVE-2026-14249

References