The vulnerability is a broken access control flaw in the enituretechnology LTL Freight Quotes – Unishippers Edition WordPress plugin that allows an attacker to bypass authorization checks due to incorrectly configured access control security levels. Because the plugin fails to verify user permissions before allowing certain actions, an attacker with minimal access could perform privileged operations, potentially exposing sensitive shipping data or modifying configuration settings. The flaw is classified as CWE‑862, indicating missing authorization.

Vendors and products affected are enituretechnology’s WordPress plugin LTL Freight Quotes – Unishippers Edition. All releases from the first available version up through version 2.5.8 are vulnerable. No other vendor or product is listed.

The CVSS score is 6.5, indicating a medium impact. The EPSS is reported as less than 1 %, meaning the likelihood of exploitation is very low at the time of this analysis. The vulnerability is not yet listed in the CISA KEV catalog, so no publicly known exploits have been observed. The most likely attack vector is through unauthenticated or low‑privileged HTTP requests to the plugin’s admin endpoints, where the missing authorization check can be leveraged to gain elevated rights.