Request a Quote Form Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Request a Quote Form plugin for WordPress, affecting versions through 2.5.2. The vulnerability arises from the plugin's emd_form_builder_lite_pagenum function, which fails to properly validate user input before using it as a function name. This oversight allows unauthenticated attackers to execute code on the server, although they cannot pass parameters to the invoked functions.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the vulnerable WordPress site is hosted.

Remediation

Users are advised to update the Request a Quote Form plugin to version 2.5.3 or a newer patched version.