A critical vulnerability in the Addify Request a Quote for WooCommerce plugin allows unauthenticated attackers to execute arbitrary code on the server.

The plugin fails to perform necessary file extension and MIME type validation within the afrfq_submit_quote_via_popup() function. This oversight allows unauthenticated attackers to upload malicious executable files, such as PHP scripts, to a web-accessible directory.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk to business operations. Successful exploitation grants an attacker the ability to execute arbitrary code on the web server, potentially leading to full site compromise, exfiltration of sensitive customer data, and unauthorized administrative access to the WooCommerce environment.

Immediate Action: Update the Addify Request a Quote for WooCommerce plugin to the latest available version immediately to patch the insecure upload handler.

Proactive Monitoring: Monitor web server access logs for requests directed at the temporary RFQ upload directory, specifically looking for attempts to access or execute files with non-standard extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block direct execution of files within the plugin's upload directories and restrict file types allowed in HTTP POST requests until the update can be applied.

Public Exploit Available: No

Given the critical severity of this flaw and the lack of authentication required for exploitation, immediate patching is essential. Organizations should prioritize updating this plugin to eliminate the risk of remote code execution, as the current version provides an unrestricted vector for attackers to gain control over the underlying web server.