CVE-2026-24366 describes a missing authorization vulnerability in the YITH WooCommerce Request A Quote plugin (versions up to 2.46.0). The issue arises from incorrectly configured access control security levels, allowing unauthorized remote attackers to access functionality without proper permissions. The vulnerability has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating it can be exploited over the network without privileges or user interaction and results in limited confidentiality impact. No patch or vendor advisory information is currently available.

The vulnerability allows unauthorized remote attackers to bypass access controls, potentially exposing limited confidential information within the affected plugin. There is no indication of integrity or availability impact. No known exploits are reported in the wild. The moderate CVSS score reflects the network exploitability and confidentiality impact without privilege or user interaction requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin's functionality or disabling the plugin if feasible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.