The Request a Quote for WooCommerce plugin for WordPress allows unauthenticated attackers to upload arbitrary files because the popup upload handler "afrfq_submit_quote_via_popup()" lacks proper file extension and MIME type validation. An attacker can supply an executable file such as PHP and have it placed in a web‑accessible temporary upload directory, enabling the execution of arbitrary code on the host. This flaw, identified as CWE-434, represents a severe security risk with a CVSS score of 9.8.

Addify’s Request a Quote for WooCommerce plugin, versions up to and including 2.9.2, are affected. The vulnerability requires that a public quote rule with the multi‑page popup flow is enabled; no other versions or configurations are known to be impacted.

The high CVSS score indicates a critical severity, and the EPSS score of 2% indicates a low but non‑zero probability of exploitation in the near term. The flaw is not listed in CISA’s KEV catalog. Based on the description, the attack vector is through the web interface, where an unauthenticated user can submit a file via the AJAX popup handler. Successful exploitation would allow the attacker to upload and subsequently execute malicious code on the web server.