tadrik Free store check

Plugin security / YITH Request a Quote for WooCommerce

YITH Request a Quote for WooCommerce vulnerability: is your WooCommerce store affected?

YITH Request a Quote for WooCommerce has one serious security hole rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 3 September 2026. Every one is fixed: update to 4.46.0 or newer.

Short answer: your store is affected if it runs YITH Request a Quote for WooCommerce older than 4.46.0. Update to 4.46.0 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 8 were running a version of YITH Request a Quote for WooCommerce with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Missing permission check

    An action that should need permission could be done without it.

    Score 9.8 (critical)no login neededAffected: older than 4.46.0Fixed in 4.46.0Published 3 September 2026CVE-2026-84238

    Advisory: Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find YITH Request a Quote for WooCommerce. The version number is under its name. If it is lower than 4.46.0, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/yith-woocommerce-request-a-quote-premium/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update YITH Request a Quote for WooCommerce to 4.46.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use YITH Request a Quote for WooCommerce.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use YITH Request a Quote for WooCommerce, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which YITH Request a Quote for WooCommerce version fixes it?
Version 4.46.0 or newer fixes the issue on this page.
How do I know if my store is affected?
Your store is affected if it runs YITH Request a Quote for WooCommerce older than 4.46.0. In WordPress, open Plugins and read the version under YITH Request a Quote for WooCommerce. Without logging in, open yourstore.com/wp-content/plugins/yith-woocommerce-request-a-quote-premium/readme.txt and read the Stable tag line.
I don't use YITH Request a Quote for WooCommerce any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.