The LTL Freight Quotes – Unishippers Edition WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) via the 'edit_id' parameter. The plugin fails to properly escape user input and does not sufficiently prepare the SQL query, enabling attackers without authentication to append malicious SQL commands. This vulnerability affects all versions up to and including 2.5.8 and can be exploited to extract sensitive data from the backend database. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, no privileges required, no user interaction, and impact on confidentiality only.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until a patch is available, consider restricting access to the plugin's functionality or disabling it if feasible to reduce exposure.