CVE-2026-3646 LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update
Unauthenticated attackers can modify plugin settings, downgrading paid plans and disabling premium features due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3646?
CVE-2026-3646 is a medium-severity missing authorization vulnerability in enituretechnology LTL Freight Quotes – R+L Carriers Edition, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling.
Weakness: CWE-862
Which versions are affected by CVE-2026-3646?
How do I fix CVE-2026-3646?
No fix has been published for CVE-2026-3646 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3646 being exploited?
There is no known exploitation of CVE-2026-3646 in the wild and no public exploit code.
Sources
Also known as GHSA-5cr3-m7xx-pv5v.