{"id":"CVE-2026-87781","published":"2026-10-10T06:16:43.807","lastModified":"2026-10-13T20:36:00.850","description":"The LTL Freight Quotes  WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e600ef26-5aec-4e4a-96be-d67875c337a0/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability exists in the LTL Freight Quotes WordPress plugin version 4.2.18 and earlier, allowing unauthenticated attackers to inject malicious SQL code into database queries. This flaw can lead to unauthorized data access and potential database compromise.","exploitability":"The vulnerability is highly exploitable with no authentication required, as attackers can directly inject SQL parameters through plugin endpoints without any preconditions.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive customer data, modify freight quotes, or potentially gain deeper access to the WordPress database and application.","remediation":"Upgrade to version 4.2.19 or later to remediate the SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:55:44.597Z"}}