Loading vulnerability…
CVE-2026-18143 is an unauthenticated arbitrary file-upload vulnerability in Addify Request a Quote for WooCommerce for WordPress through version 2.9.2. The popup quote-submission AJAX handler, afrfq_submit_quote_via_popup(), fails to enforce server-side file-extension and MIME-type validation and passes an attacker-controlled filename to move_uploaded_file(). An attacker can upload a dangerous file type, including PHP, into a web-accessible temporary upload location when the vulnerable quote workflow is exposed.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This six-file repository contains a standalone Python 3 proof-of-concept for CVE-2026-18143 in Addify's Request a Quote for WooCommerce plugin through version 2.9.2. Its main and only code file, `poc.py`, uses `requests` and `urllib3` to normalize supplied targets, fingerprint the WordPress plugin from public plugin files and page markers, parse an apparent plugin version, extract a frontend RFQ nonce from page content, and submit multipart upload requests to the WordPress AJAX endpoint. It supports single-target checking, optional active benign upload verification, explicit exploit mode, proxying, JSONL output, and threaded check-only processing of a target list. The exploit attempts multiple common plugin upload directories and can retrieve the uploaded PHP file for marker-based confirmation. `README.md` documents commands, prerequisites, FOFA fingerprints, the affected plugin path, and the public-popup-rule requirement; `requirements.txt` lists requests and urllib3; and `targets.example.txt` supplies a sample target. This is an active upload/RCE-validation PoC rather than a detection-only script, although successful PHP execution depends on the target's public popup workflow, valid nonce, writable upload location, and web execution of uploaded PHP.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated arbitrary file-upload vulnerability in Request a Quote for WooCommerce through version 2.9.2. Missing file-extension and MIME-type validation permits upload of attacker-supplied executable files, including PHP, into a web-accessible temporary RFQ upload directory when a public quote rule using the multi-page popup flow is enabled.
A critical (CVSS 9.8) unauthenticated arbitrary file-upload vulnerability in Addify's Request a Quote for WooCommerce WordPress plugin. It permits upload of executable PHP files to a web-accessible directory, enabling remote code execution when a public quote rule and the multi-page popup flow are enabled.
An unauthenticated arbitrary-file-upload vulnerability in Request a Quote for WooCommerce for WordPress through version 2.9.2. Missing file-extension and MIME-type validation lets an attacker supply a raw filename to `move_uploaded_file()` and upload executable files, including PHP, to a web-accessible temporary RFQ upload directory when a public quote rule using the multi-page popup flow is enabled. The listed CVSS v3.1 vector is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.