Based on the description, the Request a Quote plugin for WordPress contains a code injection flaw in its AJAX handler emd_delete_file. The handler forms a PHP function name from the attacker‑controlled $_POST['path'] parameter and calls it dynamically via a variable‑function call. Because the action is registered for wp_ajax_nopriv and its sole protection is a nonce displayed on the public quote‑form page, the plugin permits an unauthenticated attacker to invoke zero‑argument PHP functions, such as phpinfo. The likely attack vector is an unauthenticated AJAX request to the emd_delete_file action from a client that has access to the public quote‑form. This weakness, a classic Code Injection (CWE‑74), can lead to disclosure of server configuration, credentials, or further compromise by invoking additional destructive built‑in PHP functions.

This vulnerability affects the WordPress plugin emarket-design:Request a Quote – Quote Forms for Any WordPress Site in all releases up to and including version 2.5.5. Any site that has installed a vulnerable version of this plugin is at risk.

The vulnerability carries a CVSS score of 7.5, classifying it as high severity, and an EPSS score of less than 1%, indicating a very low but nonzero likelihood of exploitation. Based on the description, it is inferred that a remote unauthenticated attacker could trigger the emd_delete_file action by sending a crafted AJAX request from a client that can access the public quote‑form page. As the plugin is not listed in the CISA KEV catalog, no confirmed exploitation has been reported yet, but the low barrier to attack means a successful exploitation could compromise confidentiality, integrity, and availability of the affected WordPress installation.