WordPress - Request A Quote For WooCommerce - CRITICAL - CVE-2026-18143. The Request a Quote for WooCommerce plugin is susceptible to an Arbitrary File Upload vulnerability in all versions up to and including 2.9.2. This vulnerability arises from inadequate validation of file extensions and MIME types in the upload handler associated with the `afrfq_submit_quote_via_popup()` function. As a result, unauthenticated attackers can exploit this flaw to upload malicious files, such as PHP scripts, to a publicly accessible temporary directory. This situation becomes especially critical when a public quote rule utilizing the multi-page popup flow is active, allowing attackers to execute harmful code on the host server.