Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-3646 The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and in… https://www.cve.org/CVERecord?id=CVE-2026-3646
Post summary
The post announces CVE‑2026‑3646 as a missing‑authorization vulnerability in the LTL Freight Quotes plugin, but provides no PoC, exploit, patch, or active exploitation details.
CVE-2026-3646 Missing Authorization in LTL Freight Quotes R+L Carriers WordPress Plugin 3.3.13 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3646
Post summary
The post discloses CVE-2026-3646 as a missing authorization flaw in the LTL Freight Quotes R+L Carriers WordPress Plugin 3.3.13, providing only basic technical detail and no evidence of a PoC, exploit code, or active exploitation.