CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= 2.46.0.
Explanation of Vulnerability in Simple Terms
YITH WooCommerce Request A Quote versions up to 2.46.0 lack proper authorization checks, allowing unauthenticated attackers to read sensitive quote data. The plugin does not verify user permissions before exposing quote information accessible over the network. Site administrators should update to a version newer than 2.46.0 to restrict access to authorized users only.
What an attacker can do
Read quote data without logging in or having permission to access it.
Potential impact on your site
Customers' quote requests and associated sensitive business information may be exposed to unauthorized parties.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
