WordPress Request a Quote Plugin Dynamic Code Injection

The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Request a Quote WordPress plugin versions up to 2.5.5 contain a critical code injection vulnerability in the emd_delete_file AJAX action handler. An attacker can manipulate the $_POST['path'] parameter to inject arbitrary PHP function names, which are then executed dynamically through variable-function calls. Because this AJAX action is registered with wp_ajax_nopriv and relies solely on a nonce value published in the public quote form page, unauthenticated attackers can forge valid requests and achieve remote code execution. This affects any WordPress installation running the vulnerable plugin, making it a significant threat to thousands of potentially exposed websites that use this plugin for quote functionality.

Casky's 322 mapped security skills detect this attack pattern by correlating MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance) with CWE-74 (Improper Neutralization of Special Elements in Output). Practitioners using Casky would identify findings related to: (1) suspicious AJAX requests to wp-admin/admin-ajax.php with emd_delete_file action and unusual 'path' parameters containing PHP function references; (2) dynamic function invocation patterns in WordPress logs indicating variable-function calls with attacker-controlled input; (3) nonce validation failures or successful nonce reuse from public-facing quote forms; and (4) post-exploitation indicators such as unexpected code execution, file writes, or reverse shell callbacks. The extended reasoning capability allows detection of the entire attack chain—from reconnaissance of the public nonce, through crafting malicious AJAX payloads, to monitoring for abnormal PHP execution patterns that indicate successful code injection.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14249.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

achieving-cmmc-level-2-compliance

compliance governance · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-14249

Casky has 322 skills that investigate the attack patterns behind CVE-2026-14249. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn