CVE-2026-90988
MediumCVSS 5.3Summary
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
Risk Assessment
Unauthorized individuals can access customer contact data, constituting a privacy breach and potentially leading to abuse. The risk affects all sites with the vulnerable plugin version.
Recommendation
Update the Request a Quote plugin to a version later than 2.5.6 if available. Until then, consider disabling the plugin or restricting access to the AJAX handler.
Other vulnerabilities in Request a Quote
See all- CVE-2026-14249High
The Request a Quote plugin for WordPress up to version 2.5.5 is vulnerable to Code Injection via the emd_delete_file AJAX action. An unauthenticated attacker can invoke arbitrary zero-argument PHP functions, such as phpinfo(), by manipulating the $_POST['path'] parameter.
- CVE-2025-58915Medium
The Request a Quote plugin for WordPress (from emarket-design) contains a Stored XSS vulnerability in versions up to and including 2.5.0. Improper neutralization of input during web page generation allows persistent script injection.
Original NVD description (English source)
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS