CVE-2026-14249 Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter

🗓️ 02 Jul 2026 05:35:06Reported by WordfenceType

CVE-2026-14249: Unauthenticated code injection in the Request a Quote Form Plugin ≤2.5.5 via the path parameter in the emd_delete_file AJAX action.

Reporter	Title	Published	Views	Family All 4
Circl	CVE-2026-14249	2 Jul 202605:15	–	circl
CVE	CVE-2026-14249	2 Jul 202605:35	–	cve
EUVD	EUVD-2026-41245	2 Jul 202606:34	–	euvd
NVD	CVE-2026-14249	2 Jul 202606:16	–	nvd

[
  {
    "vendor": "emarket-design",
    "product": "Request a Quote – Quote Forms for Any WordPress Site",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/class-install-deactivate.php
plugins	www.plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/common-functions.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/emd-form-builder-lite/emd-form-frontend.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5a349c4f-d2e7-47af-9013-3cfa496b3b8c
plugins	www.plugins.trac.wordpress.org/browser/request-a-quote/tags/2.5.5/includes/common-functions.php

02 Jul 2026 05:35Current

CVSS 3.17.5

CWE-74