CVE-2026-2504

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2504", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-13T22:10:20.072Z", "datePublished": "2026-02-19T04:36:23.492Z", "dateUpdated": "2026-04-08T17:21:43.481Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:43.481Z"}, "affected": [{"vendor": "dealia", "product": "Dealia \u2013 Request a quote", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Dealia \u2013 Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers in all versions up to, and including, 1.0.7. The admin nonce (DEALIA_ADMIN_NONCE) is exposed to all users with edit_posts capability (Contributor+) via wp_localize_script() in PostsController.php, while the AJAX handlers in AdminSettingsController.php only verify the nonce without checking current_user_can('manage_options'). This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin configuration."}], "title": "Dealia \u2013 Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f506ef-972c-403d-9167-ffdd93be8ea6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L243"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L309"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L416"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/PostsController.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/AdminSettingsController.php#L243"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/PostsController.php#L49"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ronnachai Sretawat Na Ayutaya"}], "timeline": [{"time": "2026-02-18T15:54:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:14:05.072101Z", "id": "CVE-2026-2504", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:14:23.380Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T21:14:05.072101Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:14:18.356Z"}}], "cna": {"title": "Dealia \u2013 Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset", "credits": [{"lang": "en", "type": "finder", "value": "Ronnachai Sretawat Na Ayutaya"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "dealia", "product": "Dealia \u2013 Request a quote", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:54:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f506ef-972c-403d-9167-ffdd93be8ea6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L243"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L309"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L416"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/PostsController.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/AdminSettingsController.php#L243"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/PostsController.php#L49"}], "descriptions": [{"lang": "en", "value": "The Dealia \u2013 Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers in all versions up to, and including, 1.0.7. The admin nonce (DEALIA_ADMIN_NONCE) is exposed to all users with edit_posts capability (Contributor+) via wp_localize_script() in PostsController.php, while the AJAX handlers in AdminSettingsController.php only verify the nonce without checking current_user_can('manage_options'). This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:43.481Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2504", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:43.481Z", "dateReserved": "2026-02-13T22:10:20.072Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:23.492Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Dealia \u2013 Request a quote", "vendor": "dealia", "versions": [{"lessThanOrEqual": "1.0.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Dealia \u2013 Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers in all versions up to, and including, 1.0.7. The admin nonce (DEALIA_ADMIN_NONCE) is exposed to all users with edit_posts capability (Contributor+) via wp_localize_script() in PostsController.php, while the AJAX handlers in AdminSettingsController.php only verify the nonce without checking current_user_can('manage_options'). This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin configuration."}, {"lang": "es", "value": "El plugin Dealia \u2013 Request a quote para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de comprobaciones de capacidad en m\u00faltiples manejadores AJAX en todas las versiones hasta la 1.0.6, inclusive. El nonce de administrador (DEALIA_ADMIN_NONCE) est\u00e1 expuesto a todos los usuarios con capacidad edit_posts (Colaborador+) a trav\u00e9s de wp_localize_script() en PostsController.PHP, mientras que los manejadores AJAX en AdminSettingsController.PHP solo verifican el nonce sin comprobar current_user_can('manage_options'). Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, restablezcan la configuraci\u00f3n del plugin."}], "id": "CVE-2026-2504", "lastModified": "2026-06-17T10:31:12.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2504", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:14:05.072101Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:46.740", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L243"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L309"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L416"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/PostsController.php#L49"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/AdminSettingsController.php#L243"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/PostsController.php#L49"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f506ef-972c-403d-9167-ffdd93be8ea6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Dealia \u2013 Request a quote", "source": "cna", "vendor": "dealia"}, "product": "dealia_\u2013_request_a_quote", "vendor": "dealia"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:02:30.394557+00:00", "value": {"mitigation_remediation": ["Upgrade the Dealia \u2013 Request a quote plugin to the latest version (1.0.8 or newer) where the capability checks have been added.", "If an upgrade is not immediately possible, disable the AJAX endpoints that lack proper permissions by removing or commenting out the relevant functions in AdminSettingsController or patching the file to add current_user_can('manage_options') checks.", "Restrict contributor and editor roles from accessing pages that expose the admin nonce, or modify wp_localize_script usage to hide the nonce from non-administrators."], "summary": {"action": "Update Plugin", "impact": "Unauthorized plugin configuration reset via contributor-level access"}, "threat_synthesis": {"affected_systems": "All WordPress installations running the Dealia \u2013 Request a quote plugin up to and including version 1.0.7 are affected. The flaw exists in the AdminSettingsController and PostsController files, and any site that has that plugin active, regardless of its WordPress version. Administrations that rely on the plugin\u2019s configuration for quoting or lead capture are at risk. Upgrading to a released version beyond 1.0.7 removes the vulnerability.", "description_and_impact": "The Dealia \u2013 Request a quote plugin for WordPress allows authenticated users with Contributor-level or higher roles to reset the plugin configuration by exploiting missing capability checks. The admin nonce is publicly exposed to anyone with edit_posts permission, while AJAX handlers only verify the nonce and do not confirm manage_options capability. An attacker who can edit posts can thus send requests that reset configuration, potentially disrupting request quoting features. This flaw does not grant code execution or access to higher privileges but compromises the integrity of the plugin\u2019s settings.", "risk_and_exploitability": "The CVSS base score is 4.3, indicating a moderate impact. The EPSS score for the vulnerability is below 1%; therefore exploitation is considered unlikely at present. The flaw is not listed in the CISA KEV catalog, so no publicly known exploit has been identified. Attackers need authenticated access with edit_posts permission, and the attack vector is likely an internal or compromised contributor account. No remote code execution or data exfiltration is possible; the primary risk is the loss of configuration data."}}}}, "created": "2026-02-19T10:06:54.864403+00:00", "updated": "2026-04-15T17:15:10.603962+00:00", "vendors": ["dealia", "dealia$PRODUCT$dealia_\u2013_request_a_quote", "wordpress", "wordpress$PRODUCT$wordpress"]}