WordPress Plugin Vulnerabilities

YITH Request a Quote for WooCommerce < 4.46.1 - Unauthenticated Insecure Direct Object Reference

Description

The YITH Request a Quote for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to 4.46.1. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
yith-woocommerce-request-a-quote
Fixed in 4.46.1

References

CVE
CVE-2026-95602
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/18dd8fae-2e89-4771-955a-173efc68304a

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Austin Ginder
Verified
No
WPVDB ID
a9bc8f46-3d91-4fb3-99f8-9f1b44f4db9c

Timeline

Publicly Published
2026-09-23 (about 24 days ago)
Added
2026-09-29 (about 17 days ago)
Last Updated
2026-09-29 (about 17 days ago)

Other

Published
Title
Published
2026-01-01
Title
Holmes <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-11-24
Title
Admin and Customer Messages After Order for WooCommerce: OrderConvo < 15 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
Published
2026-06-05
Title
Klamra Paycal for Aspaclaria < 1.1.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter
Published
2026-08-31
Title
Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API
Published
2026-04-16
Title
Fluent Forms < 6.2.0 - Unauthenticated Payment Status Modification via IDOR