WordPress Plugin Vulnerabilities

NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

Description

The plugin does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.

Proof of Concept

Affects Plugins

Plugin icon
woo-rfq-for-woocommerce
Fixed in 2.4.16

References

CVE
CVE-2026-93528

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Murad Islamzada
Submitter
Murad Islamzada
Verified
Yes
WPVDB ID
f691b9cc-7d17-4308-9646-db842d99f63f

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2024-10-14
Title
Elementor < 3.24.6 - Contributor+ Information Exposure via get_image_alt
Published
2026-07-13
Title
JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject
Published
2024-11-19
Title
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce < 6.0.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
Published
2023-12-27
Title
Product Catalog Simple < 1.7.7 - Sensitive Information Exposure via Product CSV
Published
2026-08-17
Title
WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user