CVE-2026-2504: 
WordPress vulnerability analysis and mitigation

CVE-2026-2504 is a Missing Authorization vulnerability in the Dealia – Request a Quote plugin for WordPress, allowing authenticated attackers with Contributor-level access or above to reset the plugin's configuration without proper authorization. The flaw affects all versions up to and including 1.0.7. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The plugin exposes its admin nonce (DEALIA_ADMIN_NONCE) to all users with the edit_posts capability (Contributor and above) via wp_localize_script() in PostsController.php. The AJAX handlers in AdminSettingsController.php verify only the nonce but do not perform a current_user_can('manage_options') capability check, meaning any authenticated user who obtains the nonce can invoke privileged AJAX actions and reset the plugin's configuration (Red Hat CVE).

Successful exploitation allows an authenticated attacker with Contributor-level access to reset the Dealia plugin's configuration, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress plugin's settings, and there is no evidence of lateral movement potential or sensitive data exposure beyond plugin configuration loss (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.031%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface (Red Hat CVE).

1. Reconnaissance: Identify a WordPress site running the Dealia – Request a Quote plugin version 1.0.7 or earlier with user registration enabled or an existing Contributor-level account.
2. Obtain the admin nonce: Log in as a Contributor-level (or higher) user and load a page where the plugin enqueues its scripts. The DEALIA_ADMIN_NONCE value is exposed in the page source via wp_localize_script().
3. Craft the AJAX request: Construct an HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the vulnerable AJAX action (e.g., a settings reset handler in AdminSettingsController.php), including the captured nonce as a parameter.
4. Reset plugin configuration: Submit the crafted request. Because the handler only validates the nonce and not the user's capability, the server accepts the request and resets the plugin's configuration to defaults, disrupting the site's quote request functionality (Red Hat CVE).

• Logs: WordPress access logs showing authenticated POST requests to /wp-admin/admin-ajax.php with plugin-specific AJAX action parameters (e.g., actions related to Dealia settings reset) from Contributor-level user accounts.
• Application: Unexpected reset of Dealia plugin settings or configuration to default values without administrator action.
• WordPress Audit Logs (if enabled): AJAX calls to Dealia admin handlers originating from non-administrator user accounts.

WordPress site administrators should update the Dealia – Request a Quote plugin to a version beyond 1.0.7 that includes a fix adding proper current_user_can('manage_options') capability checks to all privileged AJAX handlers. Until a patched version is available, administrators should restrict Contributor-level user registration or remove untrusted Contributor accounts. Disabling the plugin entirely is an option if the quote request functionality is not critical (Red Hat CVE).