CVE-2026-3646

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L32
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L33
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L40
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L43
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L46
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/tags/3.3.11/en-hit-to-update-plan.php#L49
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L32
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L33
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L40
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L43
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L46
• https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-rl-edition/trunk/en-hit-to-update-plan.php#L49
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492361%40ltl-freight-quotes-rl-edition&new=3492361%40ltl-freight-quotes-rl-edition&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a144c9ae-dfdb-4ea2-8c27-84d59439c72a?source=cve

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-36433An issue in Actions Semiconductor Co. Ltd Tool- Media Player…9.8
• CVE-2026-36438An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0…5.3
• CVE-2026-3644The fix for CVE-2026-0672, which rejected control characters…7.5
• CVE-2026-3645The Punnel – Landing Page Builder plugin for WordPress is vu…5.3
• CVE-2026-36453Rhymix before 2.1.31 allows insecure direct object reference…7.4
• CVE-2026-36458ChestnutCMS v1.5.10 has a SQL injection vulnerability. The c…9.8
• CVE-2026-36460Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerab…4.8
• CVE-2026-36467Unrestricted Upload of File with Dangerous Type in core/modu…7.2
• CVE-2026-36468Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 …6.1
• CVE-2026-36469CuteNews v.2.1.2 is vulnerable to Server-Side Request Forger…9.1
• CVE-2026-36470CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS)…5.8
• CVE-2026-36471Deserialization of Untrusted Data of the __post_data paramet…