CVE-2025-22289
Published: 16 February 2025
Summary
CVE-2025-22289 is a medium-severity Missing Authorization (CWE-862) vulnerability in Eniture Ltl Freight Quotes. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-22289 is a missing authorization vulnerability (CWE-862) in the WordPress plugin LTL Freight Quotes – Unishippers Edition by enituretechnology. It enables exploitation of incorrectly configured access control security levels and affects all versions of the plugin from n/a through 2.5.8. The issue was published on 2025-02-16.
Unauthenticated attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). Exploitation leads to low impacts on integrity (I:L) and availability (A:L) with no confidentiality impact (C:N) and unchanged scope (S:U), yielding a CVSS v3.1 base score of 6.5.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-unishippers-edition/vulnerability/wordpress-ltl-freight-quotes-unishippers-edition-plugin-2-5-8-broken-access-control-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2689
Vulnerability details
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (broken access control) in a public-facing WordPress plugin directly enables remote unauthenticated exploitation over the network, mapping to T1190 Exploit Public-Facing Application. Low integrity/availability impacts suggest possible data manipulation but no specific sub-techniques are clearly indicated.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly preventing exploitation of the missing authorization vulnerability in the WordPress plugin.
AC-6 implements least privilege to restrict unauthenticated access to plugin functions that should require privileges, mitigating improper access control levels.
CM-6 establishes and documents secure configuration settings for the plugin, addressing exploitation of incorrectly configured access control security levels.