CVE-2024-13476: Eniture LTL Freight Quotes SQLi Flaw

CVE-2024-13476 Overview

CVE-2024-13476 is an unauthenticated SQL injection vulnerability in the LTL Freight Quotes – GlobalTranz Edition plugin for WordPress. The flaw affects all versions up to and including 2.3.11. The vulnerable code path is the engtz_wd_save_dropship AJAX endpoint, which fails to escape user-supplied input and does not use prepared statements. Attackers can append SQL queries to existing database calls without authentication. The defect is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can extract sensitive data from the WordPress database, including credentials, session tokens, and customer records.

Affected Products

Eniture LTL Freight Quotes – GlobalTranz Edition plugin for WordPress
All versions through 2.3.11
WordPress sites using the GlobalTranz freight quoting integration

Discovery Timeline

2025-02-20 - CVE-2024-13476 published to NVD
2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13476

Vulnerability Analysis

The LTL Freight Quotes – GlobalTranz Edition plugin exposes the engtz_wd_save_dropship AJAX action to unauthenticated visitors. The handler accepts user-controlled parameters and concatenates them directly into an SQL statement executed against the WordPress database. No input escaping is performed through esc_sql() or $wpdb->prepare(), allowing attacker-supplied data to be parsed as SQL syntax.

An attacker can inject a UNION SELECT payload or stacked condition to retrieve arbitrary table contents. Targets include the wp_users table for password hashes, wp_usermeta for capabilities, and wp_options for secrets such as API keys. The attack requires no privileges and no user interaction.

Exploitation is performed over the network by issuing a crafted POST request to /wp-admin/admin-ajax.php with action=engtz_wd_save_dropship. Confidentiality impact is high; integrity and availability are not directly affected based on the CVSS vector recorded in the advisory.

Root Cause

The root cause is insufficient input sanitization combined with the absence of parameterized queries in the engtz_wd_save_dropship handler. WordPress provides $wpdb->prepare() for safe query construction, but the vulnerable code path does not invoke it. User input flows from the HTTP request directly into the SQL string.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a forged AJAX request to the plugin endpoint with a malicious payload in a vulnerable parameter. The injected SQL executes within the context of the WordPress database user. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-13476

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=engtz_wd_save_dropship from unauthenticated sources
Request bodies containing SQL metacharacters such as UNION, SELECT, --, 0x, or information_schema
Unexpected database read errors or slow query log entries referencing plugin tables
New or unfamiliar administrator accounts created shortly after suspicious AJAX activity

Detection Strategies

Inspect web server access logs for admin-ajax.php requests targeting the engtz_wd_save_dropship action
Deploy a web application firewall (WAF) rule that blocks SQL syntax in POST parameters bound to this endpoint
Enable MySQL general query logging on a temporary basis to identify injected query patterns
Correlate authentication anomalies with prior AJAX requests to the vulnerable endpoint

Monitoring Recommendations

Alert on HTTP 500 responses from admin-ajax.php paired with the engtz_wd_save_dropship action parameter
Monitor the wp_users and wp_options tables for unexpected read patterns or row counts
Track outbound traffic from the WordPress host for data exfiltration following suspicious POST requests

How to Mitigate CVE-2024-13476

Immediate Actions Required

Update the LTL Freight Quotes – GlobalTranz Edition plugin to a version released after 2.3.11 that includes the fix from WordPress Changeset 3242457
If a patched version is unavailable, deactivate and remove the plugin until a fix is applied
Rotate WordPress administrator passwords, API keys stored in wp_options, and any database credentials exposed through the vulnerability
Review the WordPress user table for unauthorized accounts and remove them

Patch Information

The vendor addressed the vulnerability in the plugin source tree under WordPress Changeset 3242457. The patch introduces proper escaping and prepared statements on the engtz_wd_save_dropship handler. Administrators should install the latest plugin release from the WordPress plugin repository.

Workarounds

Restrict access to /wp-admin/admin-ajax.php requests carrying action=engtz_wd_save_dropship at the WAF or reverse proxy layer
Apply virtual patching rules that strip or reject SQL metacharacters in the affected parameter
Limit database user privileges so the WordPress account cannot read tables outside its required scope

bash

# Example nginx rule to block requests to the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "engtz_wd_save_dropship") {
        return 403;
    }
    if ($request_body ~* "action=engtz_wd_save_dropship") {
        return 403;
    }
}