CVE-2024-13473: Eniture LTL Freight Quotes SQLi Flaw

CVE-2024-13473 Overview

The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress contains a SQL Injection vulnerability [CWE-89] affecting all versions up to and including 5.0.20. The flaw resides in the handling of the dropship_edit_id and edit_id parameters, which lack sufficient escaping and parameterized query preparation. Unauthenticated attackers can append additional SQL queries to existing database operations. This allows extraction of sensitive information from the WordPress database, including user credentials, session tokens, and administrative data.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the WordPress database, leading to disclosure of confidential records stored within affected sites.

Affected Products

Eniture LTL Freight Quotes – Worldwide Express Edition for WordPress
All versions up to and including 5.0.20
WordPress sites using the ltl-freight-quotes-worldwide-express-edition plugin

Discovery Timeline

2025-02-12 - CVE-2024-13473 published to NVD
2025-03-11 - Last updated in NVD database

Technical Details for CVE-2024-13473

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw classified under [CWE-89]. The plugin processes user-supplied values for the dropship_edit_id and edit_id parameters and concatenates them directly into SQL statements. The implementation in warehouse-dropship/wild/includes/wwe-ltl-wild-delivery-save.php at lines 264 and 387 fails to apply wpdb::prepare() or equivalent parameter binding.

Because the injection point requires no authentication, attackers can target any WordPress site running the vulnerable plugin over the public internet. The attack can be performed remotely with low complexity and without user interaction. Successful exploitation enables UNION-based or blind SQL injection techniques to enumerate database contents.

Root Cause

The root cause is improper neutralization of special characters used in SQL commands. The vulnerable code path accepts request parameters and interpolates them into queries without sanitization or prepared statements. WordPress provides the $wpdb->prepare() API specifically to prevent this class of flaw, but the plugin does not apply it consistently on the affected code paths.

Attack Vector

An unauthenticated attacker crafts an HTTP request to the vulnerable endpoint with malicious SQL payloads supplied through the dropship_edit_id or edit_id parameter. The injected SQL is appended to the existing query and executed by the database engine. Attackers typically use this technique to exfiltrate wp_users credentials, secret keys, and other sensitive WordPress configuration data. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Review for the affected source lines.

Detection Methods for CVE-2024-13473

Indicators of Compromise

HTTP requests containing SQL meta-characters (', UNION, SELECT, --, /*) within the dropship_edit_id or edit_id query parameters.
Unexpected database errors in PHP or web server logs originating from wwe-ltl-wild-delivery-save.php.
Anomalous outbound responses from the plugin endpoint containing database column names or user data.
Web server access logs showing repeated requests to the plugin's delivery save endpoint from a single source IP.

Detection Strategies

Deploy Web Application Firewall (WAF) rules to inspect the dropship_edit_id and edit_id parameters for SQL injection signatures.
Enable WordPress database query logging and alert on queries containing UNION SELECT or other suspicious constructs targeting wp_ tables.
Inventory WordPress installations to identify any site running the LTL Freight Quotes – Worldwide Express Edition plugin at version 5.0.20 or below.

Monitoring Recommendations

Monitor authentication tables (wp_users, wp_usermeta) for unauthorized access patterns and unexpected password hash reads.
Alert on HTTP 500 responses generated by the plugin endpoints, which often signal injection probing.
Forward web server and PHP error logs to a centralized SIEM for correlation against known SQL injection payload patterns.

How to Mitigate CVE-2024-13473

Immediate Actions Required

Update the LTL Freight Quotes – Worldwide Express Edition plugin to a version above 5.0.20 as released in the WordPress Plugin Change Log.
Audit web server access logs for prior exploitation attempts targeting dropship_edit_id and edit_id parameters.
Rotate WordPress administrator credentials, secret keys in wp-config.php, and any API tokens stored in the database if compromise is suspected.
Review the database for unauthorized accounts, modified user roles, or injected content.

Patch Information

The vendor addressed the vulnerability in changeset 3215844 for the ltl-freight-quotes-worldwide-express-edition plugin. Administrators should upgrade to the latest available release through the WordPress plugin updater. The fix applies proper input sanitization and prepared statements on the previously vulnerable code paths in wwe-ltl-wild-delivery-save.php.

Workarounds

Deactivate and remove the LTL Freight Quotes – Worldwide Express Edition plugin until the patch can be applied.
Restrict access to the WordPress admin and plugin endpoints using IP allowlisting at the web server or reverse proxy layer.
Deploy WAF signatures that block SQL injection payloads targeting the dropship_edit_id and edit_id parameters.
Apply the principle of least privilege to the WordPress database user, removing unnecessary FILE and SUPER privileges.

bash

# Example ModSecurity rule to block SQLi attempts on vulnerable parameters
SecRule ARGS:dropship_edit_id|ARGS:edit_id "@detectSQLi" \
    "id:1004713,phase:2,deny,status:403,\
    msg:'CVE-2024-13473 SQLi attempt against LTL Freight Quotes plugin',\
    tag:'CWE-89'"