Security readout for executives and security teams
Plain-English summary
A missing authorization check affects YITH Request a Quote for WooCommerce Premium versions before 4.46.0. An unauthenticated remote attacker may access protected functionality, with the supplied CVSS assessment indicating potentially severe confidentiality, integrity, and availability consequences. The public bundle does not identify the specific exposed operation or confirmed real-world impact.
Executive priority
Treat this as an urgent patching priority for internet-facing commerce sites. Identify affected installations immediately and upgrade or isolate them. Because the disclosed technical detail and exploitation evidence are limited, prioritize exposure reduction while monitoring vendor and Patchstack updates rather than assuming compromise solely from version presence.
Technical view
CVE-2026-84238 is classified as CWE-862, Missing Authorization. It is remotely reachable, requires no privileges or user interaction, and is rated CVSS 3.1 9.8. The supplied evidence identifies versions below 4.46.0 as affected but provides no endpoint, vulnerable code path, prerequisites, or technical impact details.
Likely exposure
Internet-facing WordPress and WooCommerce sites running the Premium plugin below 4.46.0 are the likely exposure population. Exposure cannot be determined from the product name alone; administrators must verify installation, activation, version, and external reachability. The bundle's structured affected-version field is incomplete, although its title and description specify versions below 4.46.0.
Exploitation context
No active exploitation is established by the supplied evidence, and the CVE is not identified as CISA KEV. The network-accessible, low-complexity, unauthenticated CVSS characteristics make exposed vulnerable sites attractive targets, but no public proof of concept, exploitation telemetry, or attack details are provided in the bundle.
Researcher notes
The record supports an unauthenticated missing-authorization condition and a critical CVSS vector, but not the vulnerable action, data objects, affected routes, or reproducible behavior. The structured affected entry lists versions as unavailable and defaults to unaffected, conflicting with the title and description's below-4.46.0 range. Validate against the linked CVE and Patchstack records.
Mitigation direction
- Upgrade the Premium plugin to version 4.46.0 or later after confirming vendor guidance and compatibility.
- If immediate upgrading is impossible, disable the plugin or restrict site access until vendor-supported mitigation is confirmed.
- Back up the site and database before upgrading, following established recovery procedures.
- Review YITH and Patchstack guidance for subsequent corrections or revised affected-version information.
Validation and detection
- Inventory WordPress sites for the Premium plugin and record installed and active versions.
- Confirm every active installation reports version 4.46.0 or later.
- Verify caches, deployment artifacts, and restored backups do not reintroduce an older plugin version.
- Review web, WordPress, and security logs for unexplained unauthenticated access or changes.
- Perform authorized defensive testing without using production data or destructive requests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-84238 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.