If your WooCommerce store uses the “Request a Quote for WooCommerce” plugin by Addify, a critical vulnerability disclosed in September 2026 needs your attention. The good news: a confirmed, fully-patched version already exists, and the fix is detailed enough that we can tell you exactly what changed.
What CVE-2026-18143 does
The vulnerability lives in the plugin’s popup quote submission handler — specifically a function called afrfq_submit_quote_via_popup(), which processes file uploads attached to quote requests. The function failed to properly validate file extensions and MIME types before saving uploaded files to a web-accessible temporary directory. An unauthenticated attacker could upload a PHP file disguised as an attachment, then execute it directly from that directory — remote code execution with no login required.
The vulnerability carries a CVSS 3.1 score of 9.8 (Critical). Exposure depends on your configuration: it requires a public quote rule with the multi-page popup flow enabled, which is a common setup for stores that let anonymous visitors request quotes without creating an account first.
The fix: version 2.9.3
Addify shipped 2.9.3 on September 26, 2026, as a dedicated security release. The changelog describes a genuinely thorough fix, not a quick patch:
- Quote file uploads now pass through a single, centralized validator enforcing a MIME-type allow-list and blocking executable extensions outright.
- Uploaded file content is checked against its claimed extension, closing the polyglot-file trick where a PHP payload is disguised with an image extension.
- Uploaded files are renamed to random strings on disk, removing predictable file paths attackers could guess or brute-force.
- Upload folders now have server-level guards against script execution and directory listing.
- The update includes a one-time scan that quarantines any executable files already sitting in the upload folders from before the patch — useful if your site had already been probed.
An earlier release, 2.9.2 (July 30, 2026), includes a shorter changelog entry describing the same fix, but 2.9.3 is the confirmed, complete security release — update to that version specifically rather than stopping at 2.9.2.
What to do if you run this plugin
- Check your installed version under Plugins in wp-admin, or via
wp plugin listif you manage the site over WP-CLI. - Update to 2.9.3 or later immediately.
- If you can’t update right away, disable the public quote rule that enables the multi-page popup flow — Addify’s own advisory lists this as a valid interim mitigation.
- Check your uploads directory for any unexpected PHP files, particularly if your store has had the public popup quote flow enabled for any length of time before this patch.
Why “update to X” guidance needs a real version number
We don’t publish CVE guidance telling you to “update now” without confirming an actual patched version exists — too many advisories get this wrong or leave it vague. In this case, Addify’s own changelog, a CloudFront-hosted changelog mirror, and a third-party changelog tracker all independently confirm 2.9.3 as the complete fix. That’s the version to target.