CVE-2024-13479 Overview
CVE-2024-13479 is a SQL injection vulnerability in the LTL Freight Quotes – SEFL Edition plugin for WordPress, developed by Eniture. The flaw affects all versions up to and including 3.2.4. The plugin fails to properly escape user input passed through the dropship_edit_id and edit_id parameters, and the underlying SQL query lacks adequate preparation. Unauthenticated attackers can append additional SQL statements to existing queries and extract data from the WordPress database.
Critical Impact
Unauthenticated remote attackers can exfiltrate sensitive database contents, including user credentials and configuration data, without any user interaction.
Affected Products
- Eniture LTL Freight Quotes – SEFL Edition plugin for WordPress
- All versions up to and including 3.2.4
- WordPress sites integrating Southeastern Freight Lines (SEFL) shipping quotes
Discovery Timeline
- 2025-02-19 - CVE-2024-13479 published to the National Vulnerability Database
- 2025-02-25 - Last updated in NVD database
Technical Details for CVE-2024-13479
Vulnerability Analysis
The vulnerability is classified as SQL Injection [CWE-89]. It exists because the plugin concatenates user-controlled values from the dropship_edit_id and edit_id request parameters directly into SQL statements. The plugin does not apply WordPress prepared statement APIs such as $wpdb->prepare() and does not sanitize or cast the input to integers before query construction.
Because the injection point sits in an unauthenticated request handler, attackers do not need valid WordPress credentials. The attack is reachable across the network with low complexity and requires no user interaction. Successful exploitation discloses database contents but does not directly modify data or impact availability.
Root Cause
The root cause is insufficient escaping of user-supplied parameters combined with the absence of parameterized queries. The plugin code path that processes edit operations interpolates the dropship_edit_id and edit_id values into a SQL string. Any attacker-supplied SQL fragment is parsed and executed by the database engine as part of the original query.
Attack Vector
An unauthenticated attacker sends an HTTP request to the vulnerable endpoint with a crafted payload in the dropship_edit_id or edit_id parameter. The payload uses a UNION SELECT clause or stacked subquery to retrieve arbitrary columns from the WordPress database. Common targets include the wp_users table for password hashes and the wp_options table for secrets and API keys.
No verified public proof-of-concept code is available. See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2024-13479
Indicators of Compromise
- HTTP requests containing SQL keywords such as UNION, SELECT, SLEEP(, or -- within the dropship_edit_id or edit_id parameter values.
- Unusually long query strings targeting plugin endpoints under /wp-admin/admin.php or /wp-admin/admin-ajax.php referencing the SEFL plugin.
- Database error messages in web server logs referencing syntax errors near attacker-controlled values.
- Outbound DNS or HTTP callbacks initiated from PHP processes shortly after suspicious requests to the plugin.
Detection Strategies
- Inspect WordPress and web server access logs for non-numeric values supplied to dropship_edit_id and edit_id parameters.
- Deploy a Web Application Firewall (WAF) rule set that flags SQL meta-characters in plugin parameters.
- Monitor database query logs for unexpected UNION operations originating from WordPress connection users.
Monitoring Recommendations
- Centralize WordPress, PHP-FPM, and database logs into a SIEM for correlation across the request and query layers.
- Alert on repeated HTTP 500 responses from plugin endpoints, which often indicate failed injection attempts.
- Track new administrator account creation and unexpected password resets following suspicious traffic patterns.
How to Mitigate CVE-2024-13479
Immediate Actions Required
- Update the LTL Freight Quotes – SEFL Edition plugin to a version newer than 3.2.4 as soon as a fixed release is available from Eniture.
- Deactivate and remove the plugin if a patched version is not yet deployable in your environment.
- Review WordPress user accounts and rotate administrator passwords, API keys, and secrets stored in wp_options.
Patch Information
Eniture has committed code changes to the plugin repository. See the WordPress Plugin Changeset for the corrective code that introduces proper parameter handling for the affected query paths.
Workarounds
- Apply WAF rules that block requests where dropship_edit_id or edit_id contain non-integer characters.
- Restrict access to plugin administrative endpoints by source IP at the reverse proxy or hosting platform.
- Enforce least-privilege database credentials for WordPress so the connection user cannot read sensitive tables beyond plugin requirements.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
