Release v2.9.3
Request a Quote for WooCommerce v2.9.3
What's new in v2.9.3
Request a Quote for WooCommerce v2.9.3 was released on . WooCommerce Request a Quote plugin empowers your customers to add products to a quote basket and ask for price estimations for the products they are interested in. See the full changelog below and compare with the complete version history.
Release details
Released
5.3 MB
File available
Changelog
Fixed
- Fixed CVE-2026-18143: unauthenticated arbitrary file upload via the popup quote AJAX handler (afrfq_submit_quote_via_popup). Only files for enabled "file" quote fields are accepted.
- All quote file uploads now go through one validator: field allow-list limited to WordPress-allowed MIME types, executable extensions always blocked (including double extensions such as file.php.jpg), real file content checked against the extension, size limits enforced.
- Uploaded files are stored under random names; the client-supplied file name is never used on disk.
- Upload folders are protected with .htaccess / web.config / index.php guards against script execution and directory listing.
- One-time scan moves any executable files already present in the quote upload folders to a locked quarantine folder and shows an admin warning.
- Stored file names are sanitized before being used in paths and links (admin, My Account, emails, popup review page).
Compatibility
- Requires WordPress
- 6.5
- Tested up to
- 7.1
- Requires PHP
- 8.1
- Requires WooCommerce
- 4.0
- WooCommerce tested
- 11.1
Verified safe
Request a Quote for WooCommerce v2.9.3 scanned clean with no security threats detected.
View full scan report