The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) in the 'engtz_wd_save_dropship' AJAX endpoint. This vulnerability arises from improper neutralization of special elements in SQL commands, specifically due to insufficient escaping of user input and lack of prepared statements in the SQL query construction. Exploitation allows unauthenticated attackers to append malicious SQL queries, potentially extracting sensitive data from the backend database. The vulnerability affects all versions up to 2.3.11. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database without requiring authentication. The integrity and availability of the system are not impacted according to the CVSS vector. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable AJAX endpoint if possible. Monitor for updates from enituretechnology regarding patches or mitigations. Avoid exposing the affected plugin to untrusted users or networks.