CVE-2026-14249 Overview
The Request a Quote plugin for WordPress contains a code injection vulnerability affecting versions up to and including 2.5.5. The flaw resides in the emd_delete_file AJAX action handler, which derives a PHP function name from the attacker-controlled $_POST['path'] parameter and invokes it dynamically through a variable-function call. Because the handler is registered for wp_ajax_nopriv, unauthenticated attackers can reach it. The only protection is a nonce that the plugin exposes publicly through wp_localize_script on the quote-form page, rendering the check ineffective as a security boundary.
Critical Impact
Unauthenticated attackers can invoke arbitrary zero-argument PHP functions such as phpinfo(), exposing server configuration and credentials, or trigger destructive built-in PHP functions on the server.
Affected Products
- Request a Quote plugin for WordPress, versions up to and including 2.5.5
- All WordPress installations running the vulnerable plugin with a public quote form
- Sites where the wp_ajax_nopriv_emd_delete_file action is registered
Discovery Timeline
- 2026-07-02 - CVE-2026-14249 published to the National Vulnerability Database (NVD)
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-14249
Vulnerability Analysis
The vulnerability stems from unsafe dynamic function invocation in the emd_delete_file() handler. The plugin takes the $_POST['path'] value supplied by the client and uses it to construct a PHP function name assigned to $sess_name. The handler then executes that function via the variable-function call $sess_name(). PHP evaluates the variable as the target of the call, so any string an attacker supplies becomes a live function invocation.
Because the handler is registered under wp_ajax_nopriv_emd_delete_file, WordPress accepts the request without an authenticated session. The plugin attempts to gate the call with a nonce, but that nonce is emitted to unauthenticated visitors through wp_localize_script on the public quote-form page. An attacker fetches the form, extracts the nonce, and replays it against the AJAX endpoint. The classification maps to CWE-74 (Improper Neutralization of Special Elements in Output).
Root Cause
The root cause is the use of attacker-controlled input as a PHP function identifier without an allowlist. The handler never validates that $sess_name matches an expected file-cleanup routine before executing it. Combined with a publicly reachable nonce, the design collapses the intended authorization boundary.
Attack Vector
An unauthenticated remote attacker retrieves the public quote-form page and parses the localized nonce value. The attacker then issues a POST request to admin-ajax.php targeting the emd_delete_file action with a chosen function name in the path parameter. The server executes the named zero-argument PHP function and returns any output. Suitable targets include phpinfo for reconnaissance and other built-in functions that alter server state.
No authentic exploit code has been published in the referenced advisories. Refer to the Wordfence Vulnerability Analysis and the vulnerable common-functions.php source line for the exact call site.
Detection Methods for CVE-2026-14249
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=emd_delete_file originating from unauthenticated sessions
- Requests containing a path parameter whose value matches PHP built-in function names such as phpinfo, session_destroy, or posix_getpwuid
- Web server responses to admin-ajax.php returning HTML fragments consistent with phpinfo() output
- Unexpected access patterns to the public quote-form URL immediately followed by AJAX calls to emd_delete_file
Detection Strategies
- Alert on any wp_ajax_nopriv_emd_delete_file invocation where the path parameter is not a filesystem path
- Correlate quote-form page loads with subsequent emd_delete_file AJAX requests from the same source IP within a short window
- Inspect PHP error logs for Call to undefined function warnings tied to the emd_delete_file handler, which indicate probing attempts
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and forward events to a central SIEM for rule-based analysis
- Monitor outbound network traffic from the web server for signs of data exfiltration following suspicious AJAX activity
- Track file integrity on WordPress installations to detect unauthorized modifications resulting from destructive function calls
How to Mitigate CVE-2026-14249
Immediate Actions Required
- Deactivate and remove the Request a Quote plugin on any site running version 2.5.5 or earlier until a fixed release is confirmed installed
- Block requests to admin-ajax.php where action=emd_delete_file at the web application firewall (WAF) layer
- Rotate any credentials, API keys, or secrets stored in server environment variables that could have been exposed via phpinfo()
Patch Information
Review the vendor plugin changeset for the code change addressing the dynamic function invocation. Upgrade to the fixed version once published on the WordPress plugin repository, and verify the emd_delete_file handler no longer accepts unvalidated input as a function name.
Workarounds
- Remove or comment the add_action('wp_ajax_nopriv_emd_delete_file', ...) registration to require authentication for the endpoint
- Restrict access to admin-ajax.php from anonymous clients using WAF rules that require a valid session cookie for sensitive actions
- Disable dangerous PHP functions site-wide via the disable_functions directive in php.ini to limit the impact of arbitrary invocation
# Configuration example: restrict dangerous PHP functions in php.ini
disable_functions = phpinfo,exec,system,passthru,shell_exec,proc_open,popen,session_destroy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
