CVE-2026-90988 — Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

CVE-2026-90988

Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum PUBLISHED

Description (CNA)

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.

Affected (CNA)

Vendor / product	Versions
Unknown / Request a Quote	affected 0 through 2.5.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6c02759e-b37e-43ce-a4f4-467e8af63a17/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.