The LTL Freight Quotes WordPress plugin versions 4.2.11 through 4.2.18 contain a flaw where the "edit_id" parameter is used in a database query without proper sanitisation or escaping. This deficiency enables an attacker to inject arbitrary SQL statements, potentially leading to reading sensitive data from the database or modifying existing freight quote records and thereby compromising confidentiality and integrity.

WordPress sites that have installed the LTL Freight Quotes plugin in any version from 4.2.11 up to and including 4.2.18 are affected. The vendor of the plugin is not publicly identified, which may complicate vendor‑specific support channels.

Because authentication is not required, any external user can construct a malicious request targeting the "edit_id" parameter. The absence of input validation (CWE‑89) means an attacker can reliably manipulate SQL statements. With a CVSS score of 8.6, the vulnerability is considered high severity. EPSS is not available. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog, but its exploitation potential remains significant and should be mitigated promptly.