YITH Request A Quote CVE-2026-95602

Requires a WordPress site running the YITH WooCommerce Request A Quote plugin (which depends on WooCommerce) at a version before 4.46.1, with the quote-request functionality reachable. Per the CVSS vector, exploitation is remote and unauthenticated (AV:N/PR:N) with no user interaction (UI:N) and low complexity (AC:L), so it works against default configurations where the plugin's request-a-quote endpoints are exposed. The limiting factors are impact rather than access: the flaw yields only low integrity and low availability effects (I:L/A:L) with no confidentiality impact stated (C:N), and no user data disclosure is claimed, bounding realistic damage.

The vendor/Patchstack CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) describes a remotely reachable, low-complexity, unauthenticated (PR:N) IDOR (CWE-639) requiring no user interaction - genuinely accessible signals that raise its practical relevance over a purely theoretical flaw. However, the impact is modest and the scoring is internally questionable: the reference explicitly frames this as an Insecure Direct Object Reference, yet the confidentiality metric is C:N while I:L and A:L are asserted, which is unusual since IDORs typically leak data (C) rather than degrade availability; the A:L in particular appears weakly substantiated by the terse description. No EPSS score, no CISA KEV listing, and no public POC are provided, and there is no SSVC decision data. Taken together these signals point to a real-but-low-priority issue: unauthenticated network reachability warrants patching, but the limited (I:L/A:L, no confirmed confidentiality) impact and absence of any exploitation evidence mean this is not an emergency. The 'Authentication Bypass' tag conflicts with the CWE-639 authorization/IDOR classification - this is a broken-access-control (authorization) weakness, not an authentication bypass - verify semantics before triage automation keys off the tag.

An unauthenticated attacker sends crafted requests to the plugin's quote-request handling endpoints, substituting object identifiers (e.g. quote or request IDs) that belong to other users to access or manipulate records they should not control. No public exploit code or active exploitation is reported; exploitation is inferred from the CWE-639 IDOR pattern and the AV:N/AC:L/PR:N/UI:N vector, and impact is limited to low integrity and availability effects.