CVE-2026-18143: Critical Arbitrary File Upload in Request a Quote for WooCommerce — Detection and Remediation Guide

NVD has published CVE-2026-18143, a CVSS 9.8 (Critical) unauthenticated arbitrary file upload vulnerability in the Request a Quote for WooCommerce WordPress plugin, affecting all versions up to and including 2.9.2. The flaw lives in the afrfq_submit_quote_via_popup() AJAX handler, which performs no file extension or MIME type validation and passes the raw attacker-supplied filename directly to move_uploaded_file(). The result: any unauthenticated remote attacker can drop a PHP webshell into a web-accessible upload directory and achieve remote code execution on the underlying server.

If you run WooCommerce with this plugin and have a public quote rule using the multi-page popup flow enabled, treat this as an active-compromise-risk event — not a routine patching ticket.

Introduction: Why This One Demands Immediate Attention

Arbitrary file upload bugs in WordPress plugins are the bread and butter of mass exploitation. They are trivially automatable, require no credentials, and convert directly into remote code execution — which is exactly why this class of vulnerability scores at the top of the CVSS scale. CVE-2026-18143 hits every checkbox on the "exploit me at scale" list:

• Unauthenticated: no login, no nonce theft, no social engineering required.
• Network-exploitable: a single crafted HTTP POST to WordPress's AJAX endpoint is sufficient.
• Direct-to-RCE: the uploaded file lands in a web-accessible directory. A .php payload is executable the moment it is requested.
• Widely deployed component: WooCommerce powers a significant share of global e-commerce, and quote-request plugins are common on B2B storefronts — environments that also process payment-adjacent data and customer PII.

From an IR perspective, the danger pattern is well established: scanners identify the vulnerable plugin version within hours of disclosure, webshells get planted in bulk, and monetization (SEO spam, credit card skimmers, ransomware staging, resale of access to initial access brokers) follows days later. Defenders should assume exploitation attempts begin immediately after public disclosure, if they haven't already.

Technical Analysis

Affected Product and Versions

Root Cause

The popup quote-submission handler accepts file attachments as part of the quote request flow. Two compounding failures make it exploitable:

1. Missing validation: the handler performs no file extension allowlist and no MIME type verification on uploaded files.
2. Trusting attacker-controlled input: the raw, attacker-supplied filename is used directly as the destination argument to PHP's move_uploaded_file(). This means the attacker controls both the extension and — depending on path handling — potentially portions of the destination path.

The uploaded file lands in the plugin's temporary RFQ upload directory, which is web-accessible under the WordPress uploads tree. An attacker uploads a file named, for example, shell.php, then requests it over HTTP. The web server executes it with the privileges of the PHP worker (typically www-data or the hosting account user), and the attacker has an interactive foothold.

Attack Chain (Defender's View)

1. Reconnaissance: attacker enumerates sites running the plugin (fingerprinting /wp-content/plugins/ asset paths, or scanning at scale for the popup quote flow).
2. Delivery: crafted multipart POST to /wp-admin/admin-ajax.php (or the REST/AJAX route that invokes afrfq_submit_quote_via_popup()), containing a PHP payload with an attacker-chosen filename.
3. Execution: GET request to the uploaded file under the RFQ temp upload directory (typically beneath wp-content/uploads/).
4. Post-exploitation: webshell interaction — expect follow-on commands such as whoami, uname -a, curl/wget of second-stage payloads, database credential harvesting from wp-config.php, and lateral movement into the hosting account.

Exploitation Status

At the time of writing, CVE-2026-18143 is freshly published by NVD. There is no confirmed entry in the CISA Known Exploited Vulnerabilities catalog yet — but do not let that drive your prioritization. Unauthenticated file upload to RCE in WordPress plugins is one of the fastest weaponized vulnerability classes in the ecosystem, and public proof-of-concept code for this pattern typically appears within days. Treat exploitation as imminent to likely-in-progress and operate accordingly: patch first, hunt second, assume breach if you were exposed and unpatched after disclosure.

Detection & Response

Detection for this vulnerability centers on three high-fidelity behaviors:

1. File writes: PHP (or other executable) files appearing in the WordPress uploads tree — legitimate uploads here are images, PDFs, and documents, never .php.
2. Web logs: POSTs to admin-ajax.php referencing the quote popup action, followed by GETs to suspicious filenames under uploads.
3. Post-exploitation: the web server process (php-fpm, Apache, nginx worker) spawning shell commands — a near-certain webshell indicator.

Sigma Rules

The following rules target file creation (requires Sysmon on Windows hosts or a Linux file-creation audit source — e.g., auditd/eBPF telemetry forwarded as file_event), and web server access logs for the exploit delivery pattern.

---
title: Executable File Created in WordPress Uploads Directory
id: 3f8c1a92-7b4e-4d1a-9c53-2e6b8d0f4a17
status: experimental
description: Detects creation of PHP or other executable script files inside the WordPress wp-content/uploads tree, a hallmark of arbitrary file upload exploitation such as CVE-2026-18143 (Request a Quote for WooCommerce <= 2.9.2).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18143
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains: '\wp-content\uploads\'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.phar'
      - '.aspx'
      - '.jsp'
  condition: selection_path and selection_ext
falsepositives:
  - Rare; some backup or migration plugins write PHP index files. Validate the parent directory and file content.
level: high
---
title: Exploit POST to WordPress AJAX Quote Popup Handler
id: 8d2e5b41-1c6f-4a90-b7e2-5f3a9c0d6e84
status: experimental
description: Detects HTTP POST requests to WordPress admin-ajax.php invoking the afrfq_submit_quote_via_popup action associated with CVE-2026-18143 unauthenticated arbitrary file upload in Request a Quote for WooCommerce <= 2.9.2.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18143
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|endswith: '/wp-admin/admin-ajax.php'
  selection_action:
    cs-uri-query|contains: 'afrfq_submit_quote_via_popup'
  condition: selection_method and selection_uri and selection_action
falsepositives:
  - Legitimate customer quote submissions on sites using the popup flow. Correlate with subsequent GETs to executable filenames in the uploads directory and unexpected source IPs before escalating; alert anyway during the active patching window.
level: medium
---
title: HTTP Request for Executable File in WordPress Uploads Path
id: 5b7d9e30-4a2c-4f81-9d63-8c1e7a5b2f09
status: experimental
description: Detects GET requests for PHP or other executable file extensions under the WordPress uploads directory, indicating attempted execution of an uploaded webshell consistent with CVE-2026-18143 post-exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18143
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: '/wp-content/uploads/'
  selection_ext:
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Virtually none on a healthy site; no legitimate workflow requires executing PHP directly from the uploads tree.
level: critical

KQL — Microsoft Sentinel / Defender

This query assumes Apache/nginx access logs are ingested into Sentinel via Syslog/CEF (CommonSecurityLog or Syslog), and hunts for the delivery-and-execution pattern. The second half hunts endpoint-side webshell process behavior if the host is onboarded to Defender for Endpoint.

// Hunt 1: Exploit delivery + webshell execution in web access logs (CEF/Syslog ingestion)
let UploadExt = dynamic([".php", ".phtml", ".php3", ".php4", ".php5", ".php7", ".phar"]);
let SuspiciousPosts =
    CommonSecurityLog
    | where TimeGenerated > ago(14d)
    | where RequestMethod == "POST"
    | where RequestURL has "/wp-admin/admin-ajax.php"
    | where RequestURL has "afrfq_submit_quote_via_popup"
    | project PostTime=TimeGenerated, SourceIP, RequestURL, DeviceHostName;
let WebshellGets =
    CommonSecurityLog
    | where TimeGenerated > ago(14d)
    | where RequestMethod == "GET"
    | where RequestURL has "/wp-content/uploads/"
    | where RequestURL has_any (UploadExt)
    | project GetTime=TimeGenerated, SourceIP, RequestURL, DeviceHostName;
SuspiciousPosts
| join kind=inner WebshellGets on SourceIP
| where GetTime between (PostTime .. PostTime + 1h)
| project PostTime, GetTime, SourceIP, DeviceHostName, PostURL=RequestURL, ShellURL=RequestURL1
| sort by GetTime desc;
// Hunt 2: Web server process spawning shells (Defender for Endpoint on the web host)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("php-fpm", "php", "httpd", "apache2", "nginx", "w3wp.exe")
| where FileName in~ ("bash", "sh", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "cmd.exe", "powershell.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| sort by TimeGenerated desc

Velociraptor VQL

Use this artifact to sweep web servers for dropped webshells in the uploads tree — fast, surgical, and low-noise.

-- Hunt for executable script files planted in the WordPress uploads tree
-- (CVE-2026-18143 webshell artifact sweep)
LET upload_roots = SELECT FullPath
  FROM glob(globs=['/var/www/**/wp-content/uploads/**', 'C:/inetpub/**/wp-content/uploads/**'])
  WHERE NOT IsDir

SELECT FullPath,
       Size,
       Mtime,
       Btime,
       hash(path=FullPath).SHA256 AS SHA256
FROM upload_roots
WHERE FullPath =~ '(?i)\.(php|phtml|php[3-7]|phar|aspx?|jsp)$'
ORDER BY Mtime DESC

Any hit here warrants immediate triage: pull the file, hash it, check web logs for requests to that path, and pivot into full IR scoping. On a healthy WordPress install, this query returns zero rows.

Remediation & Verification Script

Run the following on Linux web hosts to verify the plugin version, sweep for planted webshells, and harden the uploads directory against PHP execution while you patch.

#!/bin/bash
# CVE-2026-18143 — Request a Quote for WooCommerce <= 2.9.2
# Verify, sweep, and harden. Run as root or with sudo on each web host.

WP_ROOTS=$(find /var/www /srv/www /home -maxdepth 4 -type d -name "wp-content" 2>/dev/null | xargs -I{} dirname {} | sort -u)

for WP in $WP_ROOTS; do
  echo "===== Checking WordPress root: $WP ====="

  # 1) Check installed plugin version
  PLUGIN_DIR="$WP/wp-content/plugins"
  for d in "$PLUGIN_DIR"/*quote* "$PLUGIN_DIR"/*rfq* "$PLUGIN_DIR"/*afrfq*; do
    [ -d "$d" ] || continue
    VER=$(grep -riE "^\s*\*?\s*Version:" "$d"/*.php 2>/dev/null | head -1 | grep -oE "[0-9]+\.[0-9]+(\.[0-9]+)?")
    echo "[PLUGIN] $d — detected version: ${VER:-unknown}"
    if [ -n "$VER" ] && [ "$(printf '%s\n2.9.2\n' "$VER" | sort -V | head -1)" != "2.9.2" ] && [ "$VER" != "2.9.2" ]; then
      : # version > 2.9.2
    fi
    case "$VER" in
      ""|2.9.2|2.9.1|2.9.0|2.8*|2.7*|2.6*|2.5*|2.4*|2.3*|2.2*|2.1*|2.0*|1.*)
        echo "[VULNERABLE] $d at version $VER — UPDATE OR DEACTIVATE IMMEDIATELY" ;;
      *)
        echo "[OK?] $d at version $VER — confirm against vendor advisory" ;;
    esac
  done

  # 2) Sweep uploads tree for executable webshell artifacts
  echo "[SWEEP] Searching uploads tree for executable script files..."
  find "$WP/wp-content/uploads" -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.phar" -o -iname "*.php[3-7]" \) -printf "%T@ %p\n" 2>/dev/null | sort -rn | head -50

  # 3) Harden: block PHP execution in uploads (Apache .htaccess)
  HT="$WP/wp-content/uploads/.htaccess"
  if [ ! -f "$HT" ]; then
    cat > "$HT" <<'EOF'
# CVE-2026-18143 hardening — deny script execution in uploads
<FilesMatch "\.(php|phtml|phar|php[3-7])$">
  Require all denied
</FilesMatch>
php_flag engine off
EOF
    echo "[HARDEN] Wrote $HT (PHP execution denied in uploads)"
  else
    echo "[HARDEN] $HT already exists — manually verify it denies PHP execution"
  fi

done

echo "===== Done. Review any [VULNERABLE] and [SWEEP] hits immediately. ====="
"

Note for nginx hosts: .htaccess is ignored. Add a location ~* /wp-content/uploads/.*\.php$ { deny all; } block to your server config and reload nginx instead.

Remediation

1. Update the plugin immediately. Upgrade Request a Quote for WooCommerce to the latest release that supersedes 2.9.2. All versions ≤ 2.9.2 are vulnerable. If your update channel does not yet show a fixed release, proceed to step 2 without waiting.
2. If no patched version is available, disable the popup quote flow or deactivate the plugin. The vulnerability is only reachable when a public quote rule with the multi-page popup flow is enabled — disabling that flow removes the attack surface. Full deactivation is the safest interim posture.
3. Block PHP execution in the uploads tree at the web server layer (see script above). This is a permanent hardening measure, not just a CVE workaround — it neutralizes an entire class of WordPress upload bugs.
4. WAF/virtual patch: add a rule blocking requests to admin-ajax.php where the body or query contains afrfq_submit_quote_via_popup and the Content-Type is multipart/form-data, or block outright until patched if the feature is unused externally.
5. Hunt before you declare victory. Because exploitation can begin within hours of disclosure, run the file-system sweep and log hunts across the exposure window — not just from today forward. Any executable file found under wp-content/uploads/ is a full IR trigger: isolate the host, preserve logs and the artifact, rotate all credentials in wp-config.php (database, salts/keys), and scope for persistence (rogue admin users, modified theme/plugin files, cron jobs).
6. Track authoritative sources: monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-18143), the Wordfence/vendor advisory for the confirmed fixed version, and the CISA KEV catalog for escalation of exploitation status.

Executive Takeaways

• This is a "drop everything" patch for any WooCommerce storefront using this plugin with the popup quote flow: unauthenticated, network-reachable, direct RCE.
• Assume the exposure window was exploited. Patching closes the door; hunting tells you whether anyone already walked through it.
• Harden permanently: deny script execution in all upload directories across your WordPress fleet. It costs nothing and breaks entire attack classes.
• Inventory problem: if you can't answer "where do we run this plugin?" within an hour, that's the real gap to fix before the next CVE-2026-18143.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub