The Request a Quote plugin for WordPress contains a code injection flaw in its AJAX handler emd_delete_file. The handler constructs a PHP function name from the attacker‑controlled $_POST['path'] parameter and invokes it dynamically via a variable-function call. Because the action is registered for wp_ajax_nopriv and the only protection is a nonce displayed on the public quote‑form page, an unauthenticated attacker can invoke zero‑argument PHP functions such as phpinfo, file_get_contents, or destructive built‑in functions. This weakness is a classic Code Injection (CWE‑74) that can lead to disclosure of server configuration, credentials, or further compromise by invoking additional PHP functions.

This vulnerability affects the WordPress plugin emarket-design:Request a Quote – Quote Forms for Any WordPress Site in all releases up to and including version 2.5.5. Any site that has installed a vulnerable version of this plugin is at risk.

The vulnerability carries a CVSS score of 7.5, classifying it as high severity, and an EPSS score of less than 1%, indicating a very low but nonzero likelihood of exploitation. The code can be executed remotely without authentication by visiting the public quote‑form page to retrieve a crafted AJAX request to the emd_delete_file action. As the plugin is not listed in the CISA KEV catalog, no confirmed exploitation has been reported yet, but the low barrier to attack means a successful exploitation could compromise confidentiality, integrity, and availability of the affected WordPress installation.