What is the CVSS score of CVE-2026-3646?

CVE-2026-3646 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

PHP CVE-2026-3646

EUVD-2026-20042 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Wordfence

GHSA-5cr3-m7xx-pv5v

WordPress PHP Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 04:30 euvd

EUVD-2026-20042

Analysis Generated

Apr 08, 2026 - 04:30 vuln.today

CVE Published

Apr 08, 2026 - 03:36 nvd

MEDIUM 5.3

DescriptionCVE.org

The LTL Freight Quotes - R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling.

AnalysisAI

Unauthenticated attackers can modify LTL Freight Quotes - R+L Carriers Edition plugin subscription settings via a webhook handler with missing authorization controls in all versions up to 3.3.13. The vulnerability allows downgrading paid subscriptions to trial plans, changing store type, and manipulating expiration dates, effectively disabling premium features like Dropship and Hazardous Material handling. CVSS 5.3 reflects moderate integrity impact with no authentication required and network-accessible attack surface.

Technical ContextAI

The vulnerability exists in the plugin's standalone PHP webhook handler file (en-hit-to-update-plan.php) which directly processes GET parameters to update WordPress options without verifying user authentication, authorization checks (missing capability validation), or WordPress nonces. This is a violation of CWE-862 (Missing Authorization) and represents a fundamental failure to implement access controls on a sensitive administrative function. The affected plugin (CPE: cpe:2.3:a:enituretechnology:ltl_freight_quotes_-_r+l_carriers_edition:*:*:*:*:*:*:*:*) integrates with external subscription management systems via webhooks, but the handler accepts and processes modifications to critical subscription metadata without proper gating. The vulnerability leverages the fact that the standalone PHP file is independently accessible and processes user-supplied input directly into WordPress option updates, bypassing the WordPress admin authentication layer entirely.

RemediationAI

Upgrade the LTL Freight Quotes - R+L Carriers Edition plugin to a patched version beyond 3.3.13 immediately. The WordPress plugin repository at https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/ should be checked for the latest available release. The fix must include adding WordPress authentication verification (is_user_logged_in()), capability checks (current_user_can('manage_options')), and nonce validation on the en-hit-to-update-plan.php handler before processing any GET parameters that modify plugin options. Until patched, access to the vulnerable webhook file can be blocked at the web server or firewall level, or the plugin can be temporarily disabled if premium shipping and hazmat features are not critical to current operations. Site owners should audit WordPress options and user roles for unauthorized changes to subscription settings.