CVE-2026-24366
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-04-28

Assigner: Patchstack

Description
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= 2.46.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-01-22
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24366
EUVD
EUVD-2026-3791
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
yithemes yith_woocommerce_request_a_quote to 2.46.0 (inc)
yithemes yith_woocommerce_request_a_quote 2.46.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-24366 is a Broken Access Control vulnerability in the YITH WooCommerce Request A Quote WordPress plugin (up to version 2.46.0). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, allowing unauthenticated users to perform actions that should require higher privileges. [1]

Impact Analysis

This vulnerability allows unauthenticated users to perform privileged actions, potentially leading to unauthorized access or manipulation within the affected plugin. However, it has a low severity impact with a CVSS score of 5.3, indicating a low priority for exploitation. [1]

Detection Guidance

Detection of this vulnerability involves checking the version of the YITH WooCommerce Request A Quote plugin installed on your WordPress site. You can detect the vulnerable plugin version by running commands to list installed plugins and their versions, such as 'wp plugin list' using WP-CLI. Additionally, monitoring for unauthorized access attempts or unusual activity related to the plugin's functions may help identify exploitation attempts. Specific commands to detect missing authorization exploits are not provided in the available resources. [1]

Mitigation Strategies

The immediate mitigation step is to update the YITH WooCommerce Request A Quote plugin to version 2.46.1 or later, where the vulnerability is fixed. Applying this update will restore proper authorization checks and prevent unauthenticated users from exploiting the broken access control. Using automated update tools like Patchstack can also help rapidly apply this and other security patches. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart