2 lines
5.0 KiB
JSON
2 lines
5.0 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LTL Freight Quotes – R+L Carriers Edition","vendor":"enituretechnology","versions":[{"lessThanOrEqual":"3.3.13","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling."},{"lang":"es","value":"El plugin LTL Freight Quotes - R+L Carriers Edition para WordPress es vulnerable a la falta de autorización a través del gestor de webhook del plugin en todas las versiones hasta la 3.3.13, inclusive. Esto se debe a la falta de autenticación, autorización y verificación de nonce en un archivo PHP independiente que procesa directamente los parámetros GET y actualiza las opciones de WordPress. Esto permite a atacantes no autenticados modificar la configuración del plan de suscripción del plugin, degradando efectivamente la tienda de un plan de pago al Plan de Prueba, cambiando el tipo de tienda y manipulando las fechas de vencimiento de la suscripción, deshabilitando potencialmente características premium como Dropship y el manejo de Materiales Peligrosos."}],"id":"CVE-2026-3646","lastModified":"2026-07-24T21:10:00.143","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3646","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-08T18:43:15.574824Z","version":"2.0.3"}}]},"published":"2026-04-08T05:16:06.130","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L32"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L33"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L40"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L43"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L46"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L49"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L32"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L33"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L40"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L43"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L46"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L49"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492361%40ltl-freight-quotes-rl-edition&new=3492361%40ltl-freight-quotes-rl-edition&sfp_email=&sfph_mail="},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a144c9ae-dfdb-4ea2-8c27-84d59439c72a?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Secondary"}]}
|