CVE-2026-107158: LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LTL Freight Quotes – Old Dominion Editionto a version that resolves this vulnerability.Fixed in 4.2.19
Event History
Frequently Asked Questions
Which installations are affected?
Installations of LTL Freight Quotes – Old Dominion Edition running a version before 4.2.19 are affected.
Does exploitation require a WordPress account or other authentication?
No. The vulnerable REST route can be used by unauthenticated users because it lacks an authorization check.
What can an attacker change?
An attacker can modify some settings stored by the plugin, including its FreightDesk integration option, through the database-writing REST route.
Is input validation present on the affected route?
No. The affected REST route lacks both authorization checking and validation.