CVE-2026-84238: CWE-862 Missing Authorization in YITH YITH Request a Quote for WooCommerce Premium

This vulnerability, identified as CWE-862 (Missing Authorization), affects YITH Request a Quote for WooCommerce Premium versions before 4.46.0. It allows unauthenticated attackers to bypass access controls, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on all security properties. The vulnerability is published and assigned CVE-2026-84238 but lacks an official remediation level or patch information from the vendor. The affected software is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation could allow unauthenticated attackers to bypass authorization controls, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access to sensitive data, modification or deletion of data, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor the vendor's announcements for updates. Until a patch is available, restricting access to the affected plugin or disabling it may reduce exposure.