LTL Freight Quotes – GlobalTranz Edition Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the LTL Freight Quotes – GlobalTranz Edition WordPress plugin, all versions through 2.3.12. The issue arises from a missing capability check on the 'engt_wd_save_dropship' AJAX endpoint, allowing unauthorized users to modify drop shipping settings. This lack of proper authorization could be exploited by unauthenticated attackers to change important configuration details related to drop shipping.

Impact

Exploitation of this vulnerability allows for unauthorized changes to drop shipping settings, which could disrupt order fulfillment processes or create inconsistencies in shipping management.

Remediation

Users are advised to update the LTL Freight Quotes – GlobalTranz Edition plugin to version 2.3.13 or later.