LTL Freight Quotes CVE-2026-107158

No special conditions beyond the plugin being installed and active - the affected REST route is reachable by unauthenticated users on any site running LTL Freight Quotes before 4.2.19, and the route performs no authorization check or input validation before writing to the database (CVSS PR:N/UI:N/AC:L). The principal limiting factor is impact scope, not access: only 'some' of the plugin's stored settings can be modified (integrity-only, C:N/A:N), so the flaw enables configuration tampering rather than data theft or site takeover. Realistic exposure is confined to WordPress sites that have this specific plugin installed and have not updated to 4.2.19.

Signals are coherent and point to a genuine but moderate-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, consistent with the description of an unauthenticated REST route lacking an authorization check. However, impact is deliberately scoped to integrity only (C:N/I:L/A:N), yielding a medium 5.3 score rather than a critical one, because an attacker can only modify 'some' stored plugin settings - not achieve full compromise. Exploitation signals temper urgency: EPSS is low (0.17%, 6th percentile) and SSVC records Exploitation as 'none' (not observed in the wild) and is NOT on CISA KEV, so there is no evidence of active exploitation. Countervailing factors are that publicly available exploit code exists and SSVC marks the flaw Automatable=yes with partial technical impact, meaning opportunistic/automated abuse is plausible even if not yet observed. Net: a legitimate patch-worthy issue for affected WordPress sites, but a mid-tier priority rather than an emergency, given limited (integrity-only, partial) impact and absence of confirmed exploitation.

An unauthenticated attacker sends a crafted request directly to the vulnerable plugin REST route, which writes to the database without any authorization or validation check, altering stored LTL Freight Quotes settings. Public exploit code is available (WPScan), and because no authentication, user interaction, or special conditions are required, the request can be scripted and fired against any exposed site. The attacker could tamper with freight-quote configuration to disrupt or manipulate the store's shipping behavior.