CVE-2026-95602: YITH WooCommerce Auth Bypass Vulnerability

CVE-2026-95602 Overview

CVE-2026-95602 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in the YITH WooCommerce Request A Quote plugin for WordPress. The flaw affects all versions before 4.46.1 and stems from incorrectly configured access control checks on object references. An unauthenticated attacker can manipulate identifiers in requests to access or modify quote data belonging to other users. The issue is commonly categorized as an Insecure Direct Object Reference (IDOR).

Critical Impact
Unauthenticated remote attackers can tamper with quote records belonging to other users, resulting in integrity and availability impact on WooCommerce quote workflows.

Affected Products

YITH WooCommerce Request A Quote plugin for WordPress
All versions prior to 4.46.1
WordPress sites running WooCommerce with the vulnerable plugin enabled

Discovery Timeline

2026-09-23 - CVE CVE-2026-95602 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95602

Vulnerability Analysis

The vulnerability resides in the plugin's handling of object identifiers passed through HTTP requests. The plugin accepts a user-controlled key referencing a quote or related record, but does not verify that the authenticated session or request context owns that resource. As a result, an attacker can substitute another user's identifier and interact with data outside their authorization scope.

Because the attack vector is Network with Low complexity and requires no privileges or user interaction, exploitation can be automated. The confidentiality impact is rated None, while integrity and availability are Low, indicating that attackers can alter or disrupt targeted quote records without directly reading sensitive third-party data.

Root Cause

The root cause is a missing authorization check tied to a user-controlled parameter [CWE-639]. The plugin trusts the identifier submitted by the client instead of resolving the resource against the current user's session, capabilities, or nonce.

Attack Vector

An attacker crafts an HTTP request to a plugin endpoint and substitutes the identifier of another user's quote object. The request succeeds because the server-side handler enforces no ownership validation. Refer to the Patchstack Vulnerability Report for the disclosure details.

No verified proof-of-concept code is publicly available. The vulnerability class is well documented: the exploit path is a modified identifier value in a request parameter targeting a quote-management endpoint exposed by the plugin.

Detection Methods for CVE-2026-95602

Indicators of Compromise

Unexpected modifications to WooCommerce quote records not initiated by the resource owner
HTTP requests to YITH Request A Quote plugin endpoints containing sequential or enumerated identifier values
Anomalous spikes in quote-related endpoint traffic from a single source IP or user agent

Detection Strategies

Inspect web server access logs for requests to plugin endpoints where the referenced quote ID does not match the requester's session identity
Review WordPress and WooCommerce audit logs for cross-user quote reads, edits, or deletions
Correlate database writes to quote tables against the acting user context to identify ownership mismatches

Monitoring Recommendations

Enable verbose logging on the YITH Request A Quote plugin endpoints and forward events to a centralized SIEM
Alert on identifier enumeration patterns such as rapid, sequential access to quote_id parameters
Baseline normal quote-endpoint traffic per authenticated user and flag deviations for review

How to Mitigate CVE-2026-95602

Immediate Actions Required

Upgrade YITH WooCommerce Request A Quote to version 4.46.1 or later on all WordPress installations
Audit existing quote records for unauthorized modifications since the plugin was installed
Restrict access to plugin endpoints at the web application firewall until patching is complete

Patch Information

The vendor addressed the flaw in YITH WooCommerce Request A Quote version 4.46.1. Administrators should update through the WordPress plugin manager or by deploying the patched release from the vendor. Details of the fix are referenced in the Patchstack Vulnerability Report.

Workarounds

Disable the YITH WooCommerce Request A Quote plugin until the update to 4.46.1 is applied
Deploy WAF rules that validate authenticated session ownership against quote identifiers in requests
Restrict quote endpoints to authenticated users only and rate-limit requests per source

bash

# Configuration example
wp plugin update yith-woocommerce-request-a-quote --version=4.46.1
wp plugin list --name=yith-woocommerce-request-a-quote --fields=name,status,version