This vulnerability is a missing authorization flaw in the WordPress Request a Quote plugin. It allows an attacker who can trigger the plugin’s request‑quote functionality to bypass the intended restricted access and harness capabilities normally reserved for authenticated administrators. The weakness corresponds to CWE‑862, where access control enforcement fails, enabling the elevation of privileges within the plugin’s domain.

The affected product is the emarket‑design Request a Quote WordPress plugin, versions from the earliest available up to and including 2.5.3. No specific minor revision details are listed, so any installation matching or older than 2.5.3 may be vulnerable.

The CVSS score of 4.3 places the issue in the medium severity range. With an EPSS score of less than 1%, the probability that attackers have already mounted this attack is very low, and the vendor does not list it in the CISA KEV catalog. The likely attack vector requires the attacker to interact with the plugin’s request‑quote endpoint, which could be exposed to both authenticated and unauthenticated users depending on site configuration. Because the flaw permits unauthorized use of privileged functions, it could lead to information disclosure or unapproved actions within the WordPress site if exploited.