CVE-2026-14249: Emarket-Design Request A Quote – Quote Forms For Any WordPress Site

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.

Affected products

• Emarket-Design Request A Quote – Quote Forms For Any WordPress Site: up to and including 2.5.5

Published 2026-07-02. Last modified 2026-07-02.