CVE-2026-107158

Deferred Deferred - Pending Action

Unauthenticated Settings Modification in LTL Freight Quotes WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107158

EUVD

EUVD-2026-100887

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	LTL	Freight Quotes 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the LTL Freight Quotes WordPress plugin before version 4.2.19. It allows unauthenticated users to modify stored plugin settings by exploiting a REST route that lacks proper authorization checks and validation. This means anyone can write to the database without permission.

Detection Guidance

Check if the LTL Freight Quotes WordPress plugin version is below 4.2.19. Inspect WordPress REST API logs for unauthorized POST requests to plugin settings endpoints. Use WP-CLI commands like 'wp plugin list' to verify plugin versions.

Impact Analysis

An attacker could change plugin settings, potentially disrupting functionality or injecting malicious content. Since it affects stored settings, the impact depends on the plugin's role in your WordPress site. However, unauthorized modifications could lead to data corruption or security issues.

Compliance Impact

This vulnerability could lead to unauthorized changes in data handling or storage settings, potentially violating compliance requirements for GDPR or HIPAA. Unauthorized modifications may result in improper data protection or access controls, increasing legal and regulatory risks.

Mitigation Strategies

Update the LTL Freight Quotes plugin to version 4.2.19 or later immediately. Disable the plugin temporarily if an update is not immediately available. Review and restrict access to WordPress REST API endpoints.

Hi! I’m here to help you understand CVE-2026-107158. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70