CVE-2026-3646
Missing Authorization in LTL Freight Quotes Plugin Allows Subscription Manipulation
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rl_carriers | ltl_freight_quotes | to 3.3.13 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress has a vulnerability due to missing authorization in its webhook handler. Specifically, a standalone PHP file processes GET parameters without any authentication, authorization, or nonce verification. This allows unauthenticated attackers to modify the plugin's subscription plan settings.
- Attackers can downgrade the store from a paid plan to the Trial Plan.
- They can change the store type.
- They can manipulate subscription expiration dates.
These changes can disable premium features such as Dropship and Hazardous Material handling.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized attackers to alter your plugin subscription settings without permission.
- Your store could be downgraded from a paid plan to a Trial Plan, potentially losing access to paid features.
- Premium features like Dropship and Hazardous Material handling could be disabled.
- Subscription expiration dates could be manipulated, affecting service continuity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to modify subscription plan settings and disable premium features by exploiting missing authorization in the plugin's webhook handler. However, there is no information provided about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.