Two critical WooCommerce plugin CVEs: audit your forms

Both of this week's critical WooCommerce bugs are in forms you deliberately show to strangers. CVE-2026-18143 lets an unauthenticated attacker upload a PHP file through a request-a-quote popup. CVE-2026-89055 lets anyone holding a review link permanently delete arbitrary files from your media library. Neither needs an account. Both have public proof-of-concept code. If you run WooCommerce plugins for quotes or reviews, this is a today job.

What actually happened

CVE-2026-18143 — Addify Request a Quote for WooCommerce, ≤ 2.9.2, CVSS 9.8. The popup quote handler afrfq_submit_quote_via_popup() passes the raw client-supplied filename straight into move_uploaded_file() with no extension or MIME allowlist, writing into a web-accessible temporary RFQ upload directory. An unauthenticated attacker uploads shell.php and then requests it. That is remote code execution as the web server user, which on a typical single-tenant WordPress host means the whole install plus whatever credentials sit in wp-config.php. Per the VulDB record, it was published September 26 and fixed in a release after 2.9.2. Exploitation requires a public quote rule using the multi-page popup flow — which is exactly how B2B stores configure it.

CVE-2026-89055 — Customer Reviews for WooCommerce, ≤ 5.120.0, CVSS 9.1. Missing authorization on the public AJAX handler cr_local_forms_submit. Anyone who has one of the /cusrev/{formId}/ review links you mail out after an order can read a valid submit nonce from that page, then post a review whose items[].media array contains arbitrary Media Library attachment IDs. When the review is later trashed and purged, delete_review_media_attachments() calls wp_delete_attachment() on every linked ID with no ownership check. Your product photography, your logo, your spec sheets — gone, by an unauthenticated request, on a delay. Details via Vulners and Wordfence Intelligence. WordPress.org lists the plugin at 80,000+ active installs with 5.122.0 current, so the fix is already sitting in your updates tab.

Why these WooCommerce plugin CVEs matter for your business

The pattern is the lesson. Both bugs live in the two places a store intentionally opens to unauthenticated strangers: a quote request form and a post-purchase review link. Those are revenue features. Nobody is going to remove them. So they need to be treated as your perimeter, because they are.

The quote form is a file upload you forgot was a file upload. B2B quoting means customers attach drawings, spreadsheets, purchase orders. Every one of those flows is an unauthenticated write to your disk. Disable PHP execution in upload directories at the web server level — that single hardening step neuters an entire CVE class, including this one, regardless of which plugin ships the next bug.

The deletion bug is worse than it reads. Exfiltration is loud and recoverable. Silent destruction of media library attachments is neither. It fires on trash purge, so the damage shows up days after the request, uncorrelated with anything in your logs. Ask the real question: if 200 product images vanished tonight, have you ever restored your uploads directory from backup and verified the result? Most stores have a backup. Fewer have a tested restore.

Premium plugins do not auto-update. The Addify plugin is a paid product from the vendor's own site, not the WordPress.org repository. That means no update nag in your dashboard and no automatic patch. Somebody has to log into a vendor account and pull the new release. Make a list of every paid plugin you run, who holds that license, and when it expires — an expired license is an unpatchable plugin.

Sources: VulDB CVE-2026-18143, Vulners CVE-2026-89055, Wordfence Intelligence, WordPress.org plugin page.