CVE-2026-14962 — ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id

CVE-2026-14962

ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id PUBLISHED

Description (CNA)

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.

Affected (CNA)

Vendor / product	Versions
Unknown / ELEX WooCommerce Request a Quote	affected 0 before 2.4.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/854a0756-ff87-4a65-959a-2e051a302a12/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.