The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted input in the LTL Freight Quotes – Day & Ross Edition plugin. Crafting a malicious payload allows an attacker to instantiate arbitrary PHP objects, potentially executing code on the server. The weakness is classified as CWE‑502, indicating unsafe deserialization.

The affected product is the LTL Freight Quotes – Day & Ross Edition plugin by Eniture Technology. Versions n/a through 2.1.11 are vulnerable. All users running any supported or older version up to and including 2.1.11 are impacted.

The CVSS score of 7.2 indicates significant potential impact with moderate difficulty to exploit. The EPSS score of less than 1 % suggests that exploitation attempts are currently rare. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the plugin operates within a WordPress site, and the most likely attack vector would involve sending crafted data to the plugin’s deserialization endpoint, typically via an HTTP request to an administrative URL. Attackers with sufficient access could then trigger object injection to gain arbitrary code execution on the site.