cleantalk
Vulnerabilities and Security Researches

Vulnerabilities and security researches forget-a-quote-button-for-woocommerce get-a-quote-button-for-woocommerce

Direction: ascending
Nov 25, 2024

Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quo # CVE-2024-11034

CVE, Research URL

CVE-2024-11034

Home page URL

Security reports for Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quo

Application

Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quo

Date
Nov 23, 2024
Research Description
The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via fire_contact_form AJAX action in all versions up to, and including, 1.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected versions
max 1.5.
Status
vulnerable