The Dealia – Request a quote plugin for WordPress allows authenticated users with Contributor-level or higher roles to reset the plugin configuration by exploiting missing capability checks. The admin nonce is publicly exposed to anyone with edit_posts permission, while AJAX handlers only verify the nonce and do not confirm manage_options capability. An attacker who can edit posts can thus send requests that reset configuration, potentially disrupting request quoting features. This flaw does not grant code execution or access to higher privileges but compromises the integrity of the plugin’s settings.

All WordPress installations running the Dealia – Request a quote plugin up to and including version 1.0.7 are affected. The flaw exists in the AdminSettingsController and PostsController files, and any site that has that plugin active, regardless of its WordPress version. Administrations that rely on the plugin’s configuration for quoting or lead capture are at risk. Upgrading to a released version beyond 1.0.7 removes the vulnerability.

The CVSS base score is 4.3, indicating a moderate impact. The EPSS score for the vulnerability is below 1%; therefore exploitation is considered unlikely at present. The flaw is not listed in the CISA KEV catalog, so no publicly known exploit has been identified. Attackers need authenticated access with edit_posts permission, and the attack vector is likely an internal or compromised contributor account. No remote code execution or data exfiltration is possible; the primary risk is the loss of configuration data.