The LTL Freight Quotes – GlobalTranz Edition WordPress plugin contains a missing capability check on the engtz_wd_save_dropship AJAX endpoint, allowing anyone with access to the site to modify drop shipping settings without authentication. This flaw, classified as Unauthorized Access Control (CWE-862), could enable attackers to alter shipping rates, routes, or other configuration data, potentially leading to financial loss or service disruption.

All installations of the Eniture Technology LTL Freight Quotes – GlobalTranz Edition plugin up to and including version 2.3.12 are affected. The product runs within WordPress environments and is identified by the package name used by the plugin author.

The vulnerability receives a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, meaning exploitation is considered unlikely at present. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply sending requests to the unprotected AJAX endpoint from any location with access to the site, without needing valid credentials or elevated privileges.