EUVD-2026-96131
GHSA-wjc2-8p3x-27rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
ExploitSend crafted request with malicious parameter
-
ExecutionInjected SQL executes in WordPress DB
-
ImpactExtract credentials and sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the LTL Freight Quotes plugin (version 4.2.11 up to but not including 4.2.19) installed and active on a network-reachable WordPress site - exploitation is remote and unauthenticated (PR:N/UI:N) against affected installs. The description does not specify a non-default feature or configuration prerequisite, so any site running a vulnerable version with the affected request endpoint exposed is likely at risk. The primary limiting factor is deployment scope: this is a specialized LTL (less-than-truckload) freight-quote plugin with a narrow installed base, and sites already updated to 4.2.19 are not affected. |
| Impact | This is a genuinely high-priority flaw by its technical profile but with important real-world caveats. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the worst-case precondition set for a web application - and the C:H with Scope:Changed drives the 8.6 score. The vulnerability class (CWE-89 SQL injection) is well-understood and highly automatable against web targets. However, the escalating exploitation signals are absent or unprovided: there is no EPSS probability in the input, no CISA KEV listing, and no indication of public POC/exploit code (the only reference is a WPScan advisory and the NVD mirror). So the picture is 'high theoretical severity, no confirmed active-exploitation evidence yet.' The Scope:Changed assignment is also debatable for a typical plugin-level SQLi that stays within the WordPress database context; I independently assess Scope:Unchanged (see assessed vectors), which would lower the real score somewhat. Net: patch promptly because unauthenticated SQLi in a public-facing plugin is attractive and easy to weaponize once details circulate, but the limited deployment footprint of this niche freight plugin tempers mass-exploitation risk relative to a ubiquitous component. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a public-facing WordPress site running LTL Freight Quotes before 4.2.19, injecting SQL via the unsanitized parameter to read arbitrary database contents such as user credentials and secrets. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be fully automated and sprayed across many sites. No public exploit code was identified at time of analysis, but the vulnerability class is trivially exploitable with standard tooling once the parameter is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.
RemediationAI
Vendor-released patch: upgrade the LTL Freight Quotes WordPress plugin to version 4.2.19 or later - this is the only complete fix and should be prioritised on every site where the plugin is installed and active, since the injection is unauthenticated and the affected request endpoint can be reached by anyone who can reach the site (see the advisory at https://wpscan.com/vulnerability/e600ef26-5aec-4e4a-96be-d67875c337a0/). Where immediate upgrade is not possible, the most reliable short-term control is to deactivate the plugin entirely until it can be updated, accepting the loss of the freight-quote functionality on those pages; a less disruptive but weaker option is to place a virtual patch or WAF rule in front of the plugin's quote/parameter endpoints (for example an SQLi signature set covering UNION, stacked-query and boolean/error-based patterns), recognising that signature-based filtering is bypassable through encoding, comment obfuscation and case variation and must not be treated as equivalent to the patch. Because the flaw is confidentiality-oriented, also treat any install that has been exposed for a period as potentially compromised: rotate database credentials and WordPress user passwords and salts, and review database and web logs for anomalous SELECT traffic hitting plugin endpoints, so that a successful pre-patch read of credential hashes or quote data does not become persistent access. If the plugin is only used in a limited administrative context, restricting access to the affected endpoint by IP or authentication at the reverse proxy adds defence in depth, but it does not remove the underlying injection and should be dropped once 4.2.19 is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, SQL injection, in a WordPress plugin rather than in WordPress core. A request parameter is taken from user input and concatenated directly into a SQL statement without sanitisation or escaping (and evidently without use of the WordPress $wpdb->prepare() parameterised-query API), so attacker-controlled syntax reaches the database engine as code rather than data. The published CPE/version data places the affected range at LTL Freight Quotes 4.2.11 through 4.2.18, fixed in 4.2.19, and the flaw was reported through WPScan, whose advisory (https://wpscan.com/vulnerability/e600ef26-5aec-4e4a-96be-d67875c337a0/) is the primary technical reference; ENISA's EUVD entry (EUVD-2026-96131) mirrors the same version range. Both the NVD-published vector and our own assessment specify PR:N/UI:N, so the injection point is reachable by completely unauthenticated remote requests. Note that the disclosed CVSS:3.1:AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (8.6) and our assessed vector CVSS:3.1:AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N differ on scope only; because both agree on C:H with I:N/A:N, the impact should be characterised as a high-severity confidentiality breach (database read/exfiltration) rather than a path to code execution or data destruction, and the schema/CMS boundary should not be treated as a scored scope change in our analysis.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Remote unauthenticated SQLi with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is database disclosure so C:H, and injection stays within the DB context so S:U rather than the input's S:C.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Executive ViewAI
A high-severity flaw in the LTL Freight Quotes WordPress plugin (versions 4.2.11 through 4.2.18) allows remote attackers to read the full contents of the underlying WordPress database, including administrator password hashes and any stored customer or quote records. Because the plugin is a specialized freight-quoting component, exposure is limited to organizations running it, but any such site reachable from the internet is directly at risk. Leadership should care because a successful attack could hand over administrative credentials and customer data, creating downstream account takeover and regulatory notification obligations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB