Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2026-18143

Vendor unknownProduct mapping pending

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.

VTP deterministic threat13.8of 100 · CVSS excluded

VTP analyst assessment

WooCommerce Request a Quote arbitrary file upload

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence78%
Public exploitation · VTP factUNKNOWN

Assessment

Public Nuclei tooling covers this WordPress plugin flaw. The popup quote-upload handler accepts attacker-controlled filenames without stated extension or MIME validation, allowing arbitrary file upload in versions through 2.9.2.

Why it matters

  • A public-facing quote form can provide the reachable upload path.
  • An attacker may upload a malicious file where the web environment permits execution.

Evidence

2 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

Public tooling does not establish exploitation in the wild or successful execution.

The supplied record does not identify a fixed release.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use Request a Quote for WooCommerce through 2.9.2, disable vulnerable upload functionality or update when a vendor fix is available.

AI baseline history (2)
  1. BASELINE ASSESSED
    WooCommerce Request a Quote arbitrary file uploadgpt-5.6-terra · low
  2. BASELINE ASSESSED
    WooCommerce quote-plugin arbitrary file uploadgpt-5.6-terra · low
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationUNKNOWNGlobal public evidence
Exploit maturityPOCReliability not implied
EPSS0.0277th percentile · prediction
Evidence confidence90%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    A proof of concept is reported; functional reliability is not established.

  2. 02

    EPSS is 0.02; this is predictive context, not exploitation evidence.

  3. 03

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

EXPLOIT TEMPLATE AVAILABLEPublic exploit-oriented template available
03

Claim provenance

Evidence and source independence

1publications detected
1underlying evidence chains

0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOIT TEMPLATE AVAILABLEPUBLIC EXPLOIT TEMPLATE
90%claim confidence
PRIMARYcorpus:NUCLEI:3de629d823bb6eb00aa3769edc365b6525134fb1ACTIVE
Evidence
04

Event history

Threat timeline

  1. 06:1115 Oct
    EXPLOIT TEMPLATE AVAILABLE

    Public exploit-oriented template available

    ProjectDiscovery nuclei-templates published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.

05

Original publications

Source record

ProjectDiscovery nuclei-templatesEXPLOIT INTELLIGENCEPRIMARY

Exploit tooling coverage changed for 2 CVEs

ProjectDiscovery nuclei-templates recorded exploit-tooling coverage changes for 2 CVEs in this pinned revision. 2 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.

CVE-2010-0738CVE-2026-18143
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score13.8vtp-threat-v1-public
Public exploitation0 / 30
EPSS prediction0.34 / 20
Exploit availability7.5 / 15
Source independence0 / 15
Intelligence recency6 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-434
CPE records
0
Deterministic history records
4
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.