The LTL Freight Quotes plugin for WordPress implements a REST route that can write to the plugin’s stored settings without performing any authorization or validation checks. An attacker can send a crafted request to that endpoint without authentication, thereby modifying configuration parameters that control freight quote behavior. Such changes could alter routing logic, affect pricing calculations, or redirect requests, undermining the integrity and reliability of the freight quotation process.

WordPress sites running the LTL Freight Quotes – Old Dominion Edition plugin with a version earlier than 4.2.19 are affected. The vulnerability applies to all installations of the plugin that have not updated to version 4.2.19 or newer.

The likelihood of exploitation is low, with an EPSS score reported as less than 1 percent and no listing in the CISA KEV catalog. However, the vulnerability is reachable from any external user without needing credentials, and the lack of CSRF or other limiting controls means that attackers can repeat the abuse. The CVSS score of 5.3 indicates a moderate potential impact, suggesting that an attacker who modifies plugin settings could affect routing logic, pricing calculations, or redirect requests, thereby undermining the integrity and reliability of the freight quotation process. The attack vector is inferred to be remote via the public WordPress REST API.