CVE-2024-13474 Overview
CVE-2024-13474 is a SQL Injection vulnerability affecting the LTL Freight Quotes – Purolator Edition plugin for WordPress. The flaw exists in all versions up to and including 2.2.3. Attackers exploit the dropship_edit_id and edit_id parameters, which lack proper escaping and prepared statement usage. Unauthenticated attackers can append SQL queries to existing database operations to extract sensitive data. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated remote attackers can extract sensitive information from the WordPress database, including user credentials, session tokens, and configuration data.
Affected Products
- LTL Freight Quotes – Purolator Edition WordPress plugin versions up to and including 2.2.3
- WordPress installations with the vulnerable plugin activated
- Any e-commerce site relying on the plugin for shipping quotes
Discovery Timeline
- 2025-02-22 - CVE-2024-13474 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-13474
Vulnerability Analysis
The vulnerability resides in how the plugin processes the dropship_edit_id and edit_id HTTP parameters. The plugin injects these user-supplied values directly into SQL statements without sanitization or parameterization. Attackers manipulate the parameters to break out of the intended query structure and append arbitrary SQL clauses. Because the queries execute under WordPress database privileges, attackers can read any table the WordPress user can access. This includes wp_users, wp_usermeta, and wp_options, which contain password hashes, session tokens, and secret keys. The vulnerability requires no authentication, allowing anonymous exploitation over the network.
Root Cause
The root cause is the absence of two defensive measures in the plugin code. First, the plugin does not escape user input using functions such as esc_sql() or sanitize_text_field(). Second, the plugin does not use the WordPress $wpdb->prepare() function to construct parameterized queries. The result is direct string concatenation between attacker-controlled input and SQL syntax.
Attack Vector
Attackers send crafted HTTP requests containing malicious payloads in the dropship_edit_id or edit_id parameters. A typical payload uses UNION-based injection to merge attacker-defined SELECT results with the legitimate query response. Time-based blind techniques also work where the response does not echo data directly. Exploitation requires only network access to the WordPress site. The vulnerability mechanism is documented in the Wordfence Vulnerability Analysis and the WordPress Trac Changeset Update.
Detection Methods for CVE-2024-13474
Indicators of Compromise
- HTTP requests containing SQL keywords such as UNION SELECT, SLEEP(, or INFORMATION_SCHEMA in dropship_edit_id or edit_id parameters
- Unusual database query latency tied to requests targeting plugin endpoints
- Web server access logs showing repeated parameter manipulation from a single source IP
- Unexpected outbound data transfers following requests to the plugin
Detection Strategies
- Inspect web server and WAF logs for SQL syntax patterns in query strings hitting the LTL Freight Quotes endpoints
- Enable MySQL general query logging temporarily to identify malformed queries originating from the plugin
- Correlate HTTP 500 responses with parameter values that contain non-numeric content in edit_id fields
Monitoring Recommendations
- Deploy a web application firewall with SQL injection rule sets tuned for WordPress traffic
- Monitor outbound traffic from the web server for data exfiltration patterns
- Alert on database connection errors and slow queries originating from the plugin
How to Mitigate CVE-2024-13474
Immediate Actions Required
- Update the LTL Freight Quotes – Purolator Edition plugin to a version higher than 2.2.3 immediately
- Audit wp_users and wp_options tables for unauthorized modifications
- Rotate WordPress secret keys, salts, and administrator passwords if exploitation is suspected
- Review web server access logs for the past 90 days for injection attempts
Patch Information
The vendor released a fix referenced in the WordPress Trac Changeset Update. The patch introduces proper input sanitization and uses prepared statements for queries involving the affected parameters. Administrators should update through the WordPress plugin dashboard or by replacing the plugin files directly.
Workarounds
- Deactivate the LTL Freight Quotes – Purolator Edition plugin until the patched version is installed
- Restrict access to plugin endpoints via .htaccess or web server configuration if the plugin must remain active
- Deploy WAF rules that block SQL metacharacters in the dropship_edit_id and edit_id parameters
# Example WAF rule blocking SQL syntax in vulnerable parameters
SecRule ARGS:dropship_edit_id|ARGS:edit_id "@rx (?i)(union|select|sleep|benchmark|information_schema|--|;)" \
"id:1004713,phase:2,deny,status:403,msg:'CVE-2024-13474 SQLi attempt blocked'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
