Introduction
A single unauthenticated request can let an attacker execute code on a WordPress site running the Request a Quote Form plugin, which can lead to full site compromise. Small businesses and B2B service providers commonly use the plugin to manage quote requests, so the impact is broad across the WordPress ecosystem.
About the Request a Quote Form plugin: The Request a Quote Form plugin is a widely used WordPress extension for managing quotes and inquiries on business websites. It has thousands of active installations, and organizations use it to automate and centralize their quoting inside WordPress.
Technical information
CVE-2025-8420 is a remote code execution vulnerability in the Request a Quote Form plugin for WordPress, and it affects all versions up to and including 2.5.2. The flaw is in the emd_form_builder_lite_pagenum function, part of the plugin's form builder. This function does not properly validate or sanitize user input before it uses that input as a function name in dynamic code execution. An unauthenticated attacker can therefore manipulate the input to run arbitrary functions on the server.
Key technical points:
- The root cause is improper input validation (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code).
- The vulnerable function treats user-supplied data as a function name, so an attacker can execute code without authenticating.
- Parameters cannot be passed to the called functions. This may limit the attacker's options, but it does not eliminate the risk of compromise.
- No public code snippets or proof of concept are available as of this writing.
Affected systems and versions
- Product: Request a Quote Form plugin for WordPress
- Affected versions: All versions up to and including 2.5.2
- Any WordPress site with this plugin at or below version 2.5.2 is vulnerable regardless of configuration.
Vendor security history
The Request a Quote Form plugin is actively developed and gets regular feature updates. This vulnerability, though, is a significant lapse in secure coding, specifically in input validation. No additional information is available about previous vulnerabilities or the vendor's patch response times.
