Request a Quote for WooCommerce Version 2.9.3 Changelog

Here’s what’s changed in Request a Quote for WooCommerce Version 2.9.3

  * Fix - Fixed CVE-2026-18143: unauthenticated arbitrary file upload via the popup quote AJAX handler (afrfq_submit_quote_via_popup). Only files for enabled "file" quote fields are accepted.
* Fix - All quote file uploads now go through one validator: field allow-list limited to WordPress-allowed MIME types, executable extensions always blocked (including double extensions such as file.php.jpg), real file content checked against the extension, size limits enforced.
* Fix - Uploaded files are stored under random names; the client-supplied file name is never used on disk.
* Fix - Upload folders are protected with .htaccess / web.config / index.php guards against script execution and directory listing.
* Fix - One-time scan moves any executable files already present in the quote upload folders to a locked quarantine folder and shows an admin warning.
* Fix - Stored file names are sanitized before being used in paths and links (admin, My Account, emails, popup review page).
  

View the full Request a Quote for WooCommerce Changelog

(No Ratings Yet)

Loading...