The YITH Request a Quote for WooCommerce Premium plugin contains an unauthenticated broken access control flaw that allows any web user to interact with endpoints intended for authenticated consumers. Attackers can create, modify, or retrieve quote requests, potentially exposing confidential information or altering data that should be restricted. The flaw permits privilege escalation by bypassing the authentication checks that normally guard these operations, compromising the confidentiality, integrity, and availability of the site’s data.

WordPress installations that use the YITH Request a Quote for WooCommerce Premium plugin with a version earlier than 4.46.0 are impacted. The vulnerability resides in the plugin code managed by YITH, so any site running a vulnerable version is exposed until the update is applied.

The base CVSS score of 9.8 signals critical severity, and although the EPSS score is not available, the lack of mitigations on many sites indicates a realistic exploitation probability. This vulnerability is not listed in the CISA KEV catalog, yet the high score suggests strong attacker motivation. The most likely attack vector involves sending unauthenticated HTTP requests to plugin REST API endpoints or other public URLs exposed by the plugin, a process that requires no special user interaction and can be performed from any network location able to reach the web server.