CVE-2024-13478: Eniture LTL Freight Quotes SQLi Flaw

CVE-2024-13478 Overview

CVE-2024-13478 is an unauthenticated SQL Injection vulnerability in the LTL Freight Quotes – TForce Edition plugin for WordPress. The flaw affects all versions up to and including 3.6.4. It stems from insufficient escaping of the dropship_edit_id and edit_id parameters combined with insufficient query preparation. Attackers can append additional SQL statements to existing queries and extract sensitive database contents without authentication. The vulnerability is tracked under CWE-89 and was published to NVD on February 19, 2025.

Critical Impact
Unauthenticated attackers can extract sensitive information from the WordPress database, including user credentials, session tokens, and configuration secrets stored in wp_options.

Affected Products

Eniture LTL Freight Quotes – TForce Edition plugin for WordPress
All versions up to and including 3.6.4
WordPress installations with the plugin active and accessible

Discovery Timeline

2025-02-19 - CVE-2024-13478 published to NVD
2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13478

Vulnerability Analysis

The plugin accepts the dropship_edit_id and edit_id request parameters and concatenates them directly into SQL statements executed against the WordPress database. Because the plugin neither escapes user input nor uses prepared statements with bound parameters, attackers can break out of the intended query context. An unauthenticated attacker reaches the vulnerable code path over the network, requiring no user interaction. Successful exploitation enables data exfiltration through UNION-based or time-based blind SQL injection techniques.

The EPSS score is 1.058% with a percentile of 60, indicating a measurable likelihood of exploitation attempts against exposed installations. WordPress plugin vulnerabilities of this class are frequently targeted by automated scanners shortly after disclosure.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command ([CWE-89]). The plugin's PHP handlers for the dropship_edit_id and edit_id parameters pass values into $wpdb->query() or equivalent calls without using $wpdb->prepare() or esc_sql(). This allows attacker-supplied input to alter query structure rather than serve as a literal value.

Attack Vector

The attack is delivered remotely over HTTP/HTTPS to any WordPress endpoint that processes the vulnerable parameters. The attacker crafts a request supplying SQL syntax in dropship_edit_id or edit_id, typically appending a UNION SELECT clause to retrieve data from tables such as wp_users or wp_usermeta. Because authentication is not required, any internet-facing site running the affected plugin is reachable.

No verified public proof-of-concept code is available at this time. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-13478

Indicators of Compromise

HTTP requests containing SQL keywords such as UNION, SELECT, SLEEP(, or -- within the dropship_edit_id or edit_id query parameters
Unexpected outbound database queries referencing wp_users, wp_usermeta, or wp_options originating from plugin handlers
Web server access logs showing repeated requests to plugin admin-ajax or REST endpoints from the same source IP
Anomalous WordPress error log entries referencing SQL syntax errors tied to the LTL Freight Quotes plugin

Detection Strategies

Inspect web application firewall logs for SQL metacharacters in dropship_edit_id and edit_id parameters
Deploy signatures matching UNION+SELECT, 0x hex payloads, and time-delay functions targeting the plugin's URIs
Correlate WordPress database error events with the requesting source IP and User-Agent to identify probing

Monitoring Recommendations

Enable verbose logging on the WordPress instance and forward access logs to a centralized SIEM
Alert on unauthenticated requests to plugin endpoints that include SQL syntax tokens
Monitor database query volume for sudden spikes correlated with plugin parameter usage

How to Mitigate CVE-2024-13478

Immediate Actions Required

Update the LTL Freight Quotes – TForce Edition plugin to a version newer than 3.6.4 as soon as a patched release is available from Eniture
Audit WordPress user accounts, password hashes, and API keys for signs of unauthorized access or exfiltration
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any database credentials stored within the application

Patch Information

The vendor commit referenced in the WordPress Plugin Changeset addresses the injection points. Administrators should verify the installed plugin version against the changeset and apply updates through the WordPress plugin manager.

Workarounds

Deactivate and remove the LTL Freight Quotes – TForce Edition plugin until a fixed version is installed
Deploy WAF rules blocking requests where dropship_edit_id or edit_id contain non-numeric characters
Restrict access to WordPress admin and AJAX endpoints by source IP where business requirements allow

bash

# Example ModSecurity rule to block SQL metacharacters in vulnerable parameters
SecRule ARGS:dropship_edit_id|ARGS:edit_id "@rx [^0-9]" \
    "id:1013478,phase:2,deny,status:403,\
     msg:'CVE-2024-13478 SQLi attempt against LTL Freight Quotes plugin',\
     logdata:'Matched: %{MATCHED_VAR}'"