Medium severity · published Oct 14, 2026
CVE-2026-107158
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LF
LTL Freight Quotes ·
before 4.2.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107158
exploit
https://wpscan.com/vulnerability/e4c4700a-25c6-4f8f-b017-ea32a81ffcb6/
More from LTL Freight Quotes
8.8
CVE-2026-87780
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules
8.6
CVE-2026-87781
LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter
5.3
CVE-2026-107160
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message