CVE-2026-18143 is a critical (CVSS 9.8) arbitrary file upload flaw in the Addify Request a Quote for WooCommerce plugin for WordPress, through version 2.9.2, that lets unauthenticated attackers upload executable files such as PHP.
What Is It
CVE-2026-18143 is an arbitrary file upload vulnerability (CWE-434) in the afrfq_submit_quote_via_popup() function of the Request a Quote for WooCommerce plugin. The popup upload handler does not check file extensions or MIME types. It passes the raw filename supplied by the attacker straight to move_uploaded_file() as the destination.
As a result, unauthenticated attackers can upload executable files, including PHP files, to a temporary RFQ upload directory that is reachable from the web. The flaw can only be exploited when a public quote rule with the multi-page popup flow is enabled.
Wordfence reported the vulnerability, and NVD published it on September 26, 2026. NVD lists its status as "Received."
Why It Matters
Wordfence scored the flaw 9.8 (Critical) under CVSS 3.1 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- It can be exploited over the network.
- The attack is not complex.
- No privileges or user interaction are needed.
- The impact on confidentiality, integrity and availability is high.
Attackers who can put PHP files in a web-accessible directory can often run code on the server. For affected WooCommerce stores, that puts the site and the data it handles at risk.
The supplied data does not include a CISA KEV entry for this CVE, so active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: Addify
- Product: Request a Quote for WooCommerce (WordPress plugin)
- Affected versions: All versions up to and including 2.9.2
- Required condition: A public quote rule with the multi-page popup flow is enabled
The NVD record lists no specific CPEs.
Patch Status
The supplied NVD record does not name a fixed version, and there is no CISA KEV entry, so no required action or due date is listed.
Site owners running version 2.9.2 or earlier should:
- Check the vendor's product page and the Wordfence advisory for an updated release.
- Until a fix is confirmed, review whether any public quote rules use the multi-page popup flow. That configuration is required for exploitation.