Executive brief
The ELEX WooCommerce Request a Quote WordPress plugin contains a SQL injection vulnerability that allows attackers to extract data from a website's database without authentication. This plugin is commonly used by online retailers to manage product quote requests, and exploitation could expose customer data, product information, and other sensitive business data stored in the database.
Technical details
The plugin fails to properly sanitize and escape the variation_id parameter before using it in a SQL query, enabling unauthenticated SQL injection attacks. An attacker can craft a malicious request with a specially crafted variation_id value to extract arbitrary data from the WordPress database. The vulnerability requires no authentication and is network-accessible, making it relatively straightforward to exploit. The vulnerability is fixed in version 2.4.1; all prior versions are affected.
Affected products
- ELEX WooCommerce Request a Quote before 2.4.1
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 2.4.1