CVE-2026-14249 describes a code injection vulnerability in the Request a Quote plugin for WordPress by emarket-design. The vulnerability arises because the emd_delete_file() handler dynamically calls a PHP function derived from the attacker-controlled $_POST['path'] parameter via a variable function call ($sess_name()). The handler is registered for unauthenticated AJAX requests (wp_ajax_nopriv) and relies solely on a nonce that is publicly exposed via wp_localize_script, making it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server. This can lead to information disclosure or execution of destructive PHP functions.

An unauthenticated attacker can execute arbitrary zero-argument PHP functions on the server, potentially exposing sensitive server configuration and credentials or causing destructive effects. The vulnerability does not require user interaction or privileges and has a low attack complexity. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict access to the vulnerable AJAX action if possible or disable the plugin to prevent exploitation.