The vulnerability CVE-2025-31406 in ELEX WooCommerce Request a Quote plugin arises from missing authorization checks, which allows an attacker with limited privileges to perform actions that should require higher authorization. The issue affects all versions up to and including 2.3.9. The CVSS score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is present. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with low privileges can exploit this missing authorization vulnerability to modify data or perform unauthorized actions within the plugin's functionality. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations for the ELEX WooCommerce Request a Quote plugin. Limit user privileges to the minimum necessary to reduce risk.