{"vulnerability": "cve-2026-18143", "sightings": [{"uuid": "a31a163c-d138-4fdc-9a1d-34f74a555f92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwfqrnvqe42n", "content": "\ud83d\udea8 BREAKING\n\nA stranger with no login can upload a PHP file and run it on your WooCommerce store.\n\nRequest a Quote for WooCommerce (through 2.9.2) has a critical file-upload flaw, and there is no patch yet.\n\nDisable the popup quote form now. (CVE-2026-18143)", "creation_timestamp": "2026-09-26T07:21:43.652610Z"}, {"uuid": "2d0e93a9-4f28-447d-b1d2-c9cdfdff226d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfrb4pkm22d", "content": "\ud83d\udd34 CVE-2026-18143 - Critical (9.8)\n\nThe Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload i...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-18143/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T07:30:22.679856Z"}, {"uuid": "f2b78bd9-d765-4625-8c60-da30e53986b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18143", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117336167086081177", "content": "CVE-2026-18143 | CRITICAL unrestricted file upload in Addify Request a Quote for WooCommerce (<=2.9.2). Unauth attackers can achieve RCE. Disable public quote rule/multi-page popup or restrict uploads. https://radar.offseq.com/threat/cve-2026-18143-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addify-request-a-quote-for-1e9c37910ddb8c12 #OffSeq #WordPress #Vuln #RCE", "creation_timestamp": "2026-09-26T07:30:23.672156Z"}, {"uuid": "99b7347a-fdc9-43e4-9b6a-33af2313624d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18143", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwfrba2qas2q", "content": "Addify Request a Quote for WooCommerce (<=2.9.2) hit by CRITICAL CVE-2026-18143: unrestricted file upload enables unauth RCE. Disable public quote/multi-page popup or limit uploads. https://radar.offseq.com/threat/cve-2026-18143-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addify-re...", "creation_timestamp": "2026-09-26T07:30:25.758462Z"}, {"uuid": "6d2f6b03-fccc-4079-ba45-0787c23df6e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwftcstqhi24", "content": "\ud83d\udea8 CVE-2026-18143 \u2014 CVSS 9.8 CRITICAL\n\nThe Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all vers...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-18143\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-26T08:07:06.242100Z"}, {"uuid": "aaaec915-9f73-4a45-8d43-797131f3caa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwg63jwtto2y", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cRequest a Quote for WooCommerce\u300d\u306e\u5168\u30d0\u30fc\u30b8\u30e7\u30f3\uff082.9.2\u307e\u3067\uff09\u3067\u3001\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304cPHP\u30d5\u2026\nCVE-2026-18143 CVSS 9.8 | CRITICAL", "creation_timestamp": "2026-09-26T11:19:52.981830Z"}, {"uuid": "25bd2c4c-5aed-48a4-b0b1-48d24c26c07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "seen", "source": "https://t.me/GithubRedTeam/103410", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 08:00:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce \u2264 2.9.2 via public AJAX afrfq_submit_quote_via_popup \u2014 unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC \u2192 pocbit.org/pocs/cve-2026-18143\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T09:00:09.000000Z"}, {"uuid": "1a39ce2f-137f-4782-b24f-3f681ccdc0d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103410", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 08:00:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce \u2264 2.9.2 via public AJAX afrfq_submit_quote_via_popup \u2014 unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC \u2192 pocbit.org/pocs/cve-2026-18143\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T09:00:09.000000Z"}, {"uuid": "9425bdb4-bcf8-4186-8dfa-aff237fd5c8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh7msd5pa2o", "content": "CVE-2026-18143 - request a quote for woocommerce\nThe Request a Quote for WooCommerce plugin for WordPress (versions up to 2.9.2) lets people who are not logged in upload files through a popup form. Because the upload\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#addify #CVE #infosec", "creation_timestamp": "2026-09-26T21:20:05.354064Z"}, {"uuid": "b2dc586d-c574-427a-adfc-28cd4beaf233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18143", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwhjpizzjj2v", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-18143: The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including\u2026\nCVSS 9.8 \u00b7 EPSS 0.4%\nhttps://beta.vulnsea.com/cve/CVE-2026-18143\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-27T00:20:33.958037Z"}, {"uuid": "99ed7fea-86be-4310-857e-7ed9ba10fc09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18143", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwinhcvh7f2a", "content": "WooCommerce Request a Quote plugin \u22642.9.2: CVE-2026-18143, CVSS 9.8 arbitrary file upload. Patch to 2.9.3 now\u2026 https://0daynews.com/articles/2026-09-27-woocommerce-request-quote-cve-2026-18143-file-upload/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3743", "creation_timestamp": "2026-09-27T11:00:14.265863Z"}]}