EUVD-2026-70563
GHSA-9fc2-7qr9-6c84
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify store running vulnerable plugin
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitReach missing-authorization endpoint
-
ExecutionInvoke privileged plugin action
-
ImpactAccess or modify protected data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running WooCommerce with the YITH Request a Quote for WooCommerce Premium plugin active at a version below 4.46.0, with the plugin's vulnerable endpoint reachable over the network. Per CVSS PR:N/UI:N, no authentication and no user interaction are required against a default install. Limiting factors: exploitation only applies to sites with this specific premium plugin installed and enabled (a relatively niche subset of WooCommerce stores), and the exact prerequisite action is not documented in the single-source advisory, so which precise feature/configuration triggers the flaw is unconfirmed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes trivially reachable, fully unauthenticated network exploitation with total confidentiality/integrity/availability impact. That impact rating should be treated with caution: the Patchstack description is a one-line 'broken access control' summary with no detail on the affected action or its sink, so the C:H/I:H/A:H triad is not independently verifiable and may overstate a flaw whose real effect is narrower (e.g., data exposure or a single privileged action). No EPSS score, KEV listing, or POC is present in the input, so there is no evidence of active exploitation - but WooCommerce plugins are high-value, internet-facing, and mass-scanned, so an operator running a vulnerable store (whether a large retailer or a mid-sized shop in inowroclaw) should treat an unauthenticated access-control gap as urgent and patch promptly rather than wait for exploitation signals. Overall: a genuine priority for anyone running the premium plugin, tempered by low-detail sourcing on exact impact. |
| Exploit ScenarioDerived | An attacker scanning WooCommerce stores identifies one running YITH Request a Quote Premium below 4.46.0 and sends a crafted unauthenticated HTTP request directly to the plugin's unprotected action, invoking a privileged operation (e.g., reading or altering quote/order data or settings) without any login. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this needs only network reachability and no user interaction; no public POC is identified yet, so exploitation would require the attacker to reverse the specific vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Missing authorization in the YITH Request a Quote for WooCommerce Premium plugin (all versions before 4.46.0) lets unauthenticated attackers reach functionality that should be access-controlled, per a Patchstack advisory. The flaw is a broken-access-control / missing-authorization issue (CWE-862) rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory does not detail the exact vulnerable action.
RemediationAI
Vendor-released patch: version 4.46.0 - update the YITH Request a Quote for WooCommerce Premium plugin to 4.46.0 or later, which is the definitive fix. Confirm the running version in WordPress > Plugins and apply the update from the YITH account/updater. If immediate patching is not possible, compensating controls include restricting access to the vulnerable endpoints at the web/WAF layer - for example blocking or rate-limiting unauthenticated requests to the plugin's admin-ajax.php actions and any custom REST routes it registers, or deploying the Patchstack vPatch/virtual-patch rule for this CVE; note that overly broad blocking of admin-ajax.php can break legitimate front-end quote-request and cart interactions, so scope rules to the specific action names. As a last resort, disable the plugin until it can be updated, accepting loss of quote-request functionality. Reference: the Patchstack advisory URL above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the premium 'Request a Quote' extension for WooCommerce (CPE cpe:2.3:a:yith:yith_request_a_quote_for_woocommerce_premium), which adds quote-request workflows to WooCommerce storefronts on WordPress. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints (typically WordPress AJAX actions or REST routes) execute privileged operations without verifying the caller's capability or nonce, so requests are honored regardless of the requester's role. Because WordPress plugins commonly register such handlers via admin-ajax.php or the REST API, an authorization gap there is directly reachable over the network.
Know when Yith Request A Quote For Woocommerce Premium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network access with no interaction is well-supported, but the thin 'broken access control' description does not substantiate full C:H/I:H/A:H, so impact assessed conservatively as L/L/N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
Articles & Coverage 1
Executive ViewAI
Organizations using the YITH Request a Quote for WooCommerce Premium plugin face immediate exposure to quote manipulation and customer pricing data theft from unauthenticated threat actors. The plugin's broken access controls (all versions before 4.46.0) eliminate authentication requirements on quote management functions, enabling fraudulent quote creation, unauthorized access to sensitive pricing information, and potential customer data harvesting across publicly accessible WooCommerce sites.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the YITH plugin if not mission-critical; (2) Restrict quote functionality to authenticated users via WordPress roles and capabilities; (3) Deploy WAF rules blocking unauthenticated quote endpoint access; (4) Implement comprehensive audit logging for all quote operations; (5) Segment quote database access with strict permissions; (6) Monitor for suspicious patterns in quote creation and modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB