6 versions
Request a Quote for WooCommerce history.
Every release of Request a Quote for WooCommerce is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
5 of 6 releases scanned clean·1 flagged
v2.9.4Latest
October 7, 20265.2 MBScanned
Fixed
- Replaced public quote PDFs with private temporary attachments and removed legacy Quotes.pdf files.
- Disabled remote resources, PHP execution, and JavaScript in PDF rendering; external/CDN images are omitted.
- Added permission checks to administrative AJAX actions and single/bulk PDF downloads; bulk downloads also require nonce validation.
- Enforced quote ownership, approved status, and enabled settings for customer conversions.
- Enforced ownership for current and legacy My Account quote details.
- Restricted quote, rule, and field administration to WooCommerce managers.
- Protected quote uploads with authorized downloads, signed guest links, and Apache/IIS access rules. Nginx requires equivalent rules.
- Validated cart conversion quote status and tokens, and corrected guest customer handling.
September 26, 20265.3 MBScanned
Fixed
- Fixed CVE-2026-18143: unauthenticated arbitrary file upload via the popup quote AJAX handler (afrfq_submit_quote_via_popup). Only files for enabled "file" quote fields are accepted.
- All quote file uploads now go through one validator: field allow-list limited to WordPress-allowed MIME types, executable extensions always blocked (including double extensions such as file.php.jpg), real file content checked against the extension, size limits enforced.
- Uploaded files are stored under random names; the client-supplied file name is never used on disk.
- Upload folders are protected with .htaccess / web.config / index.php guards against script execution and directory listing.
- One-time scan moves any executable files already present in the quote upload folders to a locked quarantine folder and shows an admin warning.
- Stored file names are sanitized before being used in paths and links (admin, My Account, emails, popup review page).
v2.9.1Unavailable
June 1, 20265.1 MBScanned
Improved
- Updated compatibility for latest WordPress and WooCommerce versions.
v2.9.0Unavailable
November 5, 20257.6 MBScanned
Added
- – Added a button color option for quote emails.
- – Implemented automatic redirection to the payment page after converting a quote to an order.
Fixed
- – Resolved an issue where the admin bar was not displaying.
- – Corrected a design issue in the popup.
- – Made minor design enhancements.
October 16, 20255.0 MBSuspicious
Added
- Added brand-specific restrictions to quote rules.
- Added an option to include notes in quotes.
- Added a feature to convert quotes directly to the cart.
- Added the ability to submit quotes via a popup.
- Added display of the quote ID in converted orders for easier reference.
- Added inclusion of shipping costs as "Shipping Fee" when converting a quote to an order.
- Added an option to hide specific payment methods when converting a quote to the cart.
Improved
- – Compatibility with Price Calculator for WooCommerce by Addify (v1.2.0 and above).
- – Compatibility with Configurable Products Builder by Addify (v1.3.0 and above).
- – Display of offered price, VAT, and total on the quote details page.
Fixed
- Fixed issue with wholesale tier pricing for the "everyone" user role in quotes.
- Fixed design compatibility issues across multiple themes.
- Fix– Improved PDF layout and styling.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Request a Quote for WooCommerce to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.