Threat database

The Request a Quote for WooCommerce WordPress plugin contains a critical arbitrary file upload vulnerability (CVE-2026-18143) in versions up to and including 2.9.2. The flaw exists in the afrfq_submit_quote_via_popup() function, which lacks proper validation of file extensions and MIME types, allowing unauthenticated attackers to upload executable files such as PHP scripts to a web-accessible directory. This can lead to full system compromise if exploited.

A critical privilege escalation vulnerability exists in the Custom User Registration Fields for WooCommerce plugin for WordPress, affecting versions up to and including 2.2.3. The flaw allows unauthenticated attackers to specify arbitrary user roles, including Administrator, during account creation at checkout if the "User Role Selection" setting is enabled. This occurs because the plugin does not validate the attacker-controlled role value before assigning it, leading to unauthorized privilege escalation.

Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5.

Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.