CVE-2026-107160 LTL Freight Quotes CVE debrief

Who should care

Defenders responsible for WordPress installations with the LTL Freight Quotes plugin should assess exposure and prioritize updating the plugin to version 4.2.19 or later. Defenders should also review and update affected systems and plugins, and monitor for potential exploitation attempts. The vulnerability allows unauthenticated HTML injection via checkout error messages, potentially leading to phishing or social engineering attacks.

Why it matters

CVE-2026-107160 is a vulnerability in the LTL Freight Quotes WordPress plugin that allows unauthenticated HTML injection via checkout error messages, potentially leading to phishing or social engineering attacks. Defenders should prioritize updating the plugin and monitoring for exploitation attempts.

• Potential injection of malicious HTML and links
• Rendering of injected content to storefront visitors
• Possible phishing or social engineering attacks
• Required verification and update of affected plugins

Technical summary

The LTL Freight Quotes WordPress plugin before version 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront. The vulnerability allows unauthenticated HTML injection via checkout error messages, potentially leading to phishing or social engineering attacks. Defenders should prioritize verifying and updating the LTL Freight Quotes plugin to version 4.2.19 or later, and monitor for potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying and updating the LTL Freight Quotes plugin to version 4.2.19 or later, and monitor for potential exploitation attempts.

Recommended defensive actions

• Verify and update the LTL Freight Quotes plugin to version 4.2.19 or later
• Monitor for potential exploitation attempts
• Review and update affected systems and plugins
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was reported by WPScan and documented in the CVE Program record and NVD vulnerability detail page. WPScan provided details on the vulnerability, including the affected plugin version and the potential impact. The CVE Program record and NVD vulnerability detail page provide additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.