CVE-2026-87781
8.6 HIGHPublished 2026-10-10 · Updated 2026-10-13
AI risk analysis
- Summary
- A SQL injection vulnerability exists in the LTL Freight Quotes WordPress plugin version 4.2.18 and earlier, allowing unauthenticated attackers to inject malicious SQL code into database queries. This flaw can lead to unauthorized data access and potential database compromise.
- Exploitability
- The vulnerability is highly exploitable with no authentication required, as attackers can directly inject SQL parameters through plugin endpoints without any preconditions.
- Blast radius
- If exploited, this vulnerability could allow attackers to extract sensitive customer data, modify freight quotes, or potentially gain deeper access to the WordPress database and application.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 4.2.19 or later to remediate the SQL injection vulnerability.
sql-injectionwordpressunauthenticated
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-103695
- CRITICALCVE-2026-62031
- HIGHCVE-2026-6806
- HIGHCVE-2026-88926
- HIGHCVE-2026-89195
- HIGHCVE-2026-89213
- HIGHCVE-2026-89214
- HIGHCVE-2026-89232
Related by shared AI tags and CWE weakness class. Browse the full archive.