What the vulnerability does
01Description
The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling.
Explanation of Vulnerability in Simple Terms
02Summary
The LTL Freight Quotes – R+L Carriers Edition plugin through version 3.3.13 lacks proper authorization checks on certain functions. An attacker without authentication can modify data or settings, though they cannot read sensitive information or disrupt service availability. Sites using this plugin should update immediately.
What an attacker can do
03Attacker Capabilities
Modify plugin data or settings without logging in.
Potential impact on your site
04Site Impact
Unauthorized changes to freight quote settings or data could disrupt quote accuracy or customer experience.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 8, 2026
CVE published
April 8, 2026
Record updated
