CVE-2026-14962: ELEX WooCommerce Request a Quote SQLI

CVE-2026-14962 Overview

CVE-2026-14962 is an unauthenticated SQL injection vulnerability in the ELEX WooCommerce Request a Quote WordPress plugin before version 2.4.1. The plugin fails to sanitize and escape a user-controlled parameter before including it in a SQL query. Unauthenticated attackers can send crafted requests to inject arbitrary SQL and extract data from the WordPress database. The flaw maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Because the plugin operates within the WooCommerce storefront, exposed sites face a direct path to customer, order, and administrative data disclosure.

Critical Impact
Unauthenticated remote attackers can extract arbitrary database contents, including WordPress user credentials and WooCommerce customer records, without user interaction.

Affected Products

ELEX WooCommerce Request a Quote WordPress plugin versions prior to 2.4.1
WordPress sites running WooCommerce with the vulnerable plugin installed
Any deployment exposing the vulnerable plugin endpoint to unauthenticated network traffic

Discovery Timeline

2026-09-09 - CVE-2026-14962 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-14962

Vulnerability Analysis

The vulnerability is a classic SQL injection issue in the plugin's request handling path. A parameter supplied by the client is concatenated into a SQL statement without prepared statements or proper escaping through wpdb::prepare(). An unauthenticated attacker can therefore append SQL syntax that alters the query logic and returns database rows outside the intended scope. According to the WPScan Vulnerability Report, the flaw permits arbitrary data extraction from the underlying MySQL or MariaDB database.

Exploitation typically leverages UNION-based or time-based blind techniques against the vulnerable parameter. Because the plugin is reachable pre-authentication, attackers do not need valid accounts or elevated privileges. The changed scope in the CVSS vector reflects that data outside the vulnerable component can be affected, which is consistent with reads across WordPress and WooCommerce tables sharing the same database.

Root Cause

The root cause is missing input validation and unsafe SQL query construction. Developer code passes the parameter directly into a query string instead of using the WordPress $wpdb->prepare() API with placeholders. The fix in version 2.4.1 introduces proper sanitization and parameterization of the affected input.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues HTTP requests to the plugin endpoint with SQL metacharacters embedded in the vulnerable parameter. Successful exploitation returns query results either directly in the HTTP response or through inferential techniques such as boolean or time-based blind injection.

No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-14962

Indicators of Compromise

HTTP requests to ELEX Request a Quote plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, INFORMATION_SCHEMA, or encoded variants
Web server access logs showing repeated parameterized requests with unusually long query strings from a single source
Unexpected WordPress database queries returning data from wp_users, wp_usermeta, or WooCommerce order tables
New or modified administrator accounts created shortly after suspicious plugin traffic

Detection Strategies

Deploy web application firewall rules that inspect requests to /wp-content/plugins/ and WooCommerce endpoints for SQL injection payload patterns
Enable MySQL general query logging in test environments and alert on queries containing tautologies such as OR 1=1 or stacked query separators
Correlate WordPress plugin version inventories against the fixed 2.4.1 release to identify exposed sites

Monitoring Recommendations

Monitor for spikes in 500-series HTTP responses from plugin endpoints, which often accompany failed injection attempts
Alert on outbound data transfer volume anomalies from WordPress hosts, indicating bulk data exfiltration
Track authentication events for newly created privileged users following anomalous plugin traffic

How to Mitigate CVE-2026-14962

Immediate Actions Required

Upgrade the ELEX WooCommerce Request a Quote plugin to version 2.4.1 or later on every WordPress instance
Audit WordPress administrator accounts and rotate credentials for any account that may have been exposed
Review web server and database logs for injection attempts dating back to plugin installation
Restrict access to WordPress admin and plugin endpoints behind a web application firewall

Patch Information

The vendor addressed the issue in ELEX WooCommerce Request a Quote version 2.4.1. Site administrators should update through the WordPress plugin dashboard or by deploying the updated package from the official plugin repository. See the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the ELEX WooCommerce Request a Quote plugin until the update is applied
Apply web application firewall signatures targeting SQL injection payloads on plugin request paths
Restrict access to the quote request endpoints by IP allowlist where feasible for staging or B2B deployments

bash

# Example WP-CLI upgrade command
wp plugin update elex-woocommerce-request-a-quote --version=2.4.1
wp plugin list --name=elex-woocommerce-request-a-quote --fields=name,status,version