The vulnerability arises from missing authorization checks in the plugin’s webhook handler, allowing any visitor to send GET requests to a standalone PHP file that updates WordPress options. Because no authentication, authorization, or nonce verification is performed, an attacker can change the subscription plan, downgrade the service, and alter expiration dates. The consequence is loss of paid features such as Dropship and Hazardous Material handling, potentially disrupting operations. This reflects a CWE‑862 missing authorization weakness.

The issue affects Eniture Technology’s LTL Freight Quotes – R+L Carriers Edition WordPress plugin, any installation of version 3.3.13 or earlier. The plugin is deployed on WordPress sites that provide freight quote services.

The plugin’s vulnerability scores a CVSS of 5.3, indicating medium risk. The EPSS score is not provided, and the vulnerability is not included in CISA’s KEV catalog. Attackers can exploit it by making unauthenticated HTTP GET requests to the vulnerable script, which then writes configuration changes to WordPress. Because the exploit does not require privileged access or authentication, the risk is potentially higher for any site that does not restrict access to the script, allowing an attacker to downgrade a store and disable premium functionality.