Yith Woocommerce Request A Quote
Monthly
Authorization bypass through a user-controlled key (CWE-639 IDOR) in the YITH WooCommerce Request A Quote plugin for WordPress allows remote attackers to act on quote-request objects they should not control, on any site running a version before 4.46.1. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation is remote, low complexity, unauthenticated and requires no user interaction, though damage is bounded to low integrity impact with no confidentiality or availability effect stated. No public exploit code identified at time of analysis, with no KEV or EPSS signals supplied, but the vendor has released a fixed version (4.46.1) and the issue was reported by Patchstack, so sites exposing the request-a-quote endpoints should treat patching as urgent housekeeping rather than a theoretical concern.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass through a user-controlled key (CWE-639 IDOR) in the YITH WooCommerce Request A Quote plugin for WordPress allows remote attackers to act on quote-request objects they should not control, on any site running a version before 4.46.1. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation is remote, low complexity, unauthenticated and requires no user interaction, though damage is bounded to low integrity impact with no confidentiality or availability effect stated. No public exploit code identified at time of analysis, with no KEV or EPSS signals supplied, but the vendor has released a fixed version (4.46.1) and the issue was reported by Patchstack, so sites exposing the request-a-quote endpoints should treat patching as urgent housekeeping rather than a theoretical concern.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.