The vulnerability is a missing authorization flaw that allows an attacker to bypass the intended access controls of the YITH WooCommerce Request A Quote plugin. Based on the description, it is inferred that an attacker can exploit this by sending benign web requests to the plugin’s endpoints, acting as an unauthenticated or improperly authenticated user, creating, modifying, or viewing quote requests that should be restricted. This can result in the disclosure or manipulation of sensitive transaction or customer data and undermines the integrity of the quoting process.

The flaw affects the YITHEMES YITH WooCommerce Request A Quote WordPress plugin for all releases up to and including version 2.46.0. Any WordPress site that has the plugin installed within this version range is potentially vulnerable.

With a CVSS score of 5.3 the issue is considered moderate severity, and the EPSS score below 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only normal web requests against the plugin’s endpoints, with no special credentials or network conditions noted. Attackers can likely target the site without advanced skills or additional tools.