Junglewise Threat Intelligence

CVE-2026-3646: Eniture Technology LTL Freight Quotes missing authorization in webhook handler

CVE-2026-3646 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Executive brief

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress, which provides shipping rate calculations for e-commerce stores, contains a security flaw in its subscription management. An unauthorized person can remotely change the store's subscription settings without a password. This could result in a paid service being downgraded to a trial version, potentially disabling critical business features like hazardous material handling or dropshipping support.

Technical details

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to missing authorization and nonce verification in the 'en-hit-to-update-plan.php' standalone file. This component directly processes GET parameters and updates WordPress options without checking for administrative privileges or authenticating the request source. An unauthenticated remote attacker can exploit this by sending crafted HTTP GET requests to the webhook handler to modify the plugin's subscription plan settings. Successful exploitation allows the attacker to downgrade the store to a Trial Plan, change the store type, or manipulate subscription expiration dates, effectively disabling premium functionality. The issue is addressed in versions following 3.3.13.

Affected products

  • Eniture Technology LTL Freight Quotes – R+L Carriers Edition <= 3.3.13

Timeline

  • 2026-04-08: disclosed: Initial disclosure by Wordfence and NVD publication.

References