CVE-2025-22289 is a medium severity (CVSS 6.5) missing authorization flaw in the LTL Freight Quotes Unishippers Edition WordPress plugin by Eniture Technology. Versions up to and including 2.5.8 are affected. Patchstack lists 2.5.9 as the patched version, so update the plugin to 2.5.9 or later.
What's affected
The NVD record covers LTL Freight Quotes Unishippers Edition (plugin slug ltl-freight-quotes-unishippers-edition) from the first release through 2.5.8. Patchstack's entry confirms the same range and names 2.5.9 as the patched version.
The Patchstack page lists the required privilege as unauthenticated. The CVSS vector is AV:N/AC:L/PR:N/UI:N with low impact on integrity and availability and none on confidentiality. That means any visitor who can reach the site may be able to trigger an action the plugin should have restricted, though the damage is limited in scope.
How to check if you're exposed
If you have WP-CLI on the server:
wp plugin list | grep -i unishippers
wp plugin get ltl-freight-quotes-unishippers-edition --field=version
Without WP-CLI, open Plugins in the WordPress admin and read the version beside LTL Freight Quotes Unishippers Edition. Any version at or below 2.5.8 is affected. Agencies that manage many shops should run the same check across every site, since this plugin is installed per store.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Update the plugin to 2.5.9 or later from the WordPress plugin screen or with wp plugin update.
- Confirm the new version number on the plugin list.
- If you cannot update today, consider deactivating the plugin on sites where shipping quotes are not business critical, and check with your host about a temporary web application firewall rule.
- Review your access logs for unusual requests to plugin endpoints around the disclosure period if you want to check for misuse.
- Add the plugin to your tracked inventory so future advisories reach you.
Why it matters
CWE-862 means missing authorization. The plugin exposes a function without checking that the caller is allowed to use it. Patchstack classes it as broken access control, the first item in the OWASP Top 10.
WordPress plugins are a common home for this bug because developers register actions that can be called by anyone and forget a capability check. The fix is usually small, which is why the vendor shipped it in a point release. Patchstack describes bugs of this type as targets for mass campaigns, but neither the NVD record nor the Patchstack page says this particular CVE is exploited, and the KEV flag is false.
Quick check
Which version fixes it?
Patchstack lists 2.5.9 as the patched version. Versions up to and including 2.5.8 are affected.
Do attackers need a login?
Patchstack lists the required privilege as unauthenticated, so no account is needed according to that entry.
Sources
Last reviewed: 19 October 2026.
