CVE-2026-95602

WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability

6.5 Medium

CVE-2026-95602 is a medium vulnerability (CVSS 6.5) in Yith Woocommerce Request A Quote, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.

What does this mean?

Severity: 6.5 MediumCVSS 3.1, CVE List
Exploit chance: 0.36%EPSS, 30th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.36%Up 0.1 points since Sep 24, 2026

Affected products

What each source reports

CVE List Score used6.5

WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Record: CVE-2026-95602
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2026-855056.5

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Record: EUVD-2026-85505
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q9qv-wpxv-x8rp6.5

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A...

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Record: GHSA-q9qv-wpxv-x8rp
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-639
Updated: 2026-11-02

NVD6.5

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Record: CVE-2026-95602
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-639
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.