CVE-2026-84238 in Request a Quote for WooCommerce Premium Plugin
Summary
by MITRE • 09/03/2026
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified as an unbroken access control issue within the YITH Request a Quote plugin for WordPress, specifically affecting versions prior to 4.46.0, represents a critical failure in server-side authorization mechanisms. This flaw allows attackers who are not authenticated or lack sufficient privileges to interact with sensitive administrative functions intended exclusively for site administrators. The core of this vulnerability lies in the insufficient verification of user permissions before processing requests that modify quote data or access restricted endpoints within the plugin's architecture. By bypassing these checks, an attacker can manipulate quotation details, view confidential pricing information, or potentially alter order-related data without possessing valid login credentials. This type of flaw is categorized under CWE-269, which addresses Improper Privilege Control, and aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it exploits the system's trust in unverified inputs to gain unauthorized access capabilities typically reserved for higher-level users.
From a technical perspective, the vulnerability stems from the plugin’s handling of AJAX requests or REST API endpoints that fail to adequately validate whether the initiating request originates from an authorized administrator session. In many WordPress plugins, certain actions are protected by nonce verification and capability checks using functions such as current_user_can. However, in this specific instance, these safeguards were either missing, incorrectly implemented, or bypassed through crafted HTTP requests. An attacker can exploit this by sending specially constructed POST requests to the vulnerable endpoints with parameters that trigger administrative operations. Since the server does not strictly enforce role-based access control on these inputs, it processes the commands as if they came from a legitimate administrator. This lack of strict input validation and authorization checks creates a direct path for unauthorized modification or retrieval of data stored within the WordPress database related to customer quotes and pricing structures.
The operational impact of this vulnerability is significant for businesses relying on WooCommerce for e-commerce operations involving custom quotations. Attackers can exploit this flaw to view sensitive business information, including negotiated prices, client contact details associated with quote requests, and internal notes added by sales teams during the quotation process. This exposure compromises customer privacy and violates data protection regulations such as GDPR or CCPA if personal identifiable information is exposed. Furthermore, an attacker could potentially alter existing quotes to inflate costs for legitimate customers or create fraudulent quotes that disrupt business operations. In more severe scenarios, depending on how other plugins interact with this data, there may be a risk of further exploitation leading to full site compromise, although the primary impact remains focused on unauthorized access and manipulation of quote-related data. The ability to act without authentication lowers the barrier for entry significantly, allowing even low-skilled attackers or automated scripts to exploit the flaw at scale.
To mitigate this vulnerability, immediate action is required by updating the YITH Request a Quote plugin to version 4.46.0 or later, where these access control issues have been addressed through improved validation logic and stricter enforcement of user capabilities. Administrators should also ensure that all WordPress core components and other installed plugins are up to date to prevent secondary exploitation vectors. Implementing Web Application Firewalls can provide an additional layer of defense by monitoring for anomalous request patterns associated with unauthorized API access or privilege escalation attempts. Regular security audits focusing on authentication and authorization flows, particularly in custom code or third-party extensions, are essential to identify similar weaknesses before they can be exploited. Adhering to secure coding standards that mandate explicit permission checks for every sensitive operation will help prevent recurrence of such broken access control issues in future software updates.