Description

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T17:17:25.150Z",
  "pubdate": "2026-09-03T17:17:25.150Z",
  "executiveSummary": "YITH Request a Quote for WooCommerce Premium versions prior to 4.46.0 contain a critical broken access control vulnerability. This flaw allows unauthenticated remote attackers to perform unauthorized actions by bypassing intended access restrictions within the plugin's request handling logic.\nThe vulnerability type is classified as Broken Access Control, specifically stemming from inadequate authorization checks on sensitive functions. The impact is significant, potentially allowing unauthorized data access, modification, or the triggering of administrative processes without valid credentials.\nThe vulnerability affects all installations of YITH Request a Quote for WooCommerce Premium below version 4.46.0. It exposes the application to unauthorized interactions from any remote unauthenticated user, effectively lowering the security posture of the WooCommerce environment.\nRisk implications include potential data exposure, manipulation of quote requests, and unauthorized access to backend functionality. Exploitation does not require authentication, making it highly accessible to automated scanning and manual exploitation attempts. Immediate patching to version 4.46.0 or higher is required to eliminate the exposure.",
  "technicalDetails": "The vulnerability exists within the request processing logic of YITH Request a Quote for WooCommerce Premium. Root cause analysis indicates that specific AJAX actions or API endpoints implemented by the plugin fail to verify the authorization status of the requester. Consequently, the server-side code executes privileged or sensitive functionality without confirming that the user possesses the necessary permissions to invoke those operations.\nIn a standard WordPress environment, plugin-specific endpoints should implement 'check_ajax_referer()' for CSRF protection and 'current_user_can()' or equivalent capability checks to ensure that the user has appropriate privileges to access the resource. In affected versions of YITH Request a Quote for WooCommerce Premium, these checks are either entirely absent or improperly implemented in specific code paths, allowing unauthenticated requests to reach backend logic that should be restricted to administrators or authorized users.\nThe attack flow commences when an unauthenticated attacker identifies the vulnerable endpoint exposed by the plugin. By crafting a specific HTTP request targeting these endpoints, the attacker can manipulate the internal state of the quote system. The request does not require prior authentication or session cookies, as the plugin code fails to validate the user's session before processing the request payload.\nUpon receiving the malicious request, the vulnerable component processes the input parameters directly. Because the authorization verification is bypassed, the plugin performs the requested actions—which might involve modifying quote data, accessing sensitive customer request details, or potentially triggering other administrative workflows—as if the request were legitimate and authorized.\nThe exploitability is facilitated by the global exposure of these endpoints in the WooCommerce environment. Since the plugin is active, the endpoints are accessible via the standard REST API or AJAX infrastructure provided by WordPress. The lack of granular access control allows an attacker to interact with the plugin's internal functionality remotely over the network. Post-exploitation, an attacker can influence quote status, potentially disrupt sales workflows, or gain insight into private user request data, depending on the specific functionality exposed by the vulnerable endpoints in the affected version."
}