Unauthorized Data Modification in GlobalTranz LTL Freight Quotes Plugin for WordPress
CVE-2025-1483

5.3MEDIUM

Key Information:

Vendor
WordPress
Status
Ltl Freight Quotes – Globaltranz Edition
Vendor
CVE Published:
20 February 2025

Summary

The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is susceptible to unauthorized data modification due to a missing capability check on the engtz_wd_save_dropship AJAX endpoint. This issue affects all versions up to and including 2.3.12, enabling unauthenticated attackers to alter drop shipping settings without authorization. A patch is recommended to mitigate these risks.

Affected Version(s)

LTL Freight Quotes – GlobalTranz Edition * <= 2.3.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3243002/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Colin Xu
.