CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition ltl-freight-quotes-daylight-edition allows Object Injection.This issue affects LTL Freight Quotes – Daylight Edition: from n/a through <= 2.2.7.
Explanation of Vulnerability in Simple Terms
LTL Freight Quotes – Daylight Edition versions 2.2.7 and earlier contain a deserialization vulnerability that allows authenticated administrators to execute arbitrary code on the site. An attacker with admin access can craft malicious serialized data that, when processed by the plugin, runs their own PHP code. This requires high-level privileges but poses a critical risk to site integrity.
What an attacker can do
Run arbitrary PHP code on the site with full administrative privileges.
Potential impact on your site
A compromised admin account can fully control your site, steal data, modify content, or install backdoors.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
