CVE-2024-13480: Eniture LTL Freight Quotes SQLi Flaw

CVE-2024-13480 Overview

CVE-2024-13480 is a SQL injection vulnerability affecting the LTL Freight Quotes – For Customers of FedEx Freight plugin for WordPress. The flaw exists in all versions up to and including 3.4.1. It stems from insufficient escaping on the edit_id and dropship_edit_id parameters combined with inadequate preparation of the underlying SQL query. Unauthenticated attackers can append additional SQL statements to existing queries and extract sensitive data from the WordPress database. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including WordPress user credentials, session data, and administrative configuration, from any site running the vulnerable plugin.

Affected Products

Eniture LTL Freight Quotes – For Customers of FedEx Freight (WordPress plugin)
All plugin versions up to and including 3.4.1
WordPress sites with the plugin enabled and reachable over the network

Discovery Timeline

2025-02-12 - CVE-2024-13480 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13480

Vulnerability Analysis

The plugin exposes administrative endpoints that accept the edit_id and dropship_edit_id request parameters. These parameter values are concatenated into SQL statements without being sanitized, escaped, or bound through prepared statements. Because the WordPress database abstraction layer (wpdb) is not used with prepare() for these queries, attacker-controlled input breaks out of the intended integer context and modifies the query structure.

An unauthenticated attacker can inject UNION SELECT payloads or stacked conditions to enumerate database schema and read arbitrary tables, including wp_users and wp_usermeta. The result of the injection is reflected through the plugin's normal query path, enabling data exfiltration without authentication.

The issue is exploitable over the network with low attack complexity and requires no user interaction, consistent with the confidentiality-only impact profile of a read-oriented SQL injection.

Root Cause

The root cause is direct interpolation of the edit_id and dropship_edit_id parameters into SQL query strings. The plugin fails to cast the values to integers or route them through $wpdb->prepare() with a %d placeholder. This class of defect maps to CWE-89.

Attack Vector

Exploitation requires only an HTTP request to the vulnerable plugin endpoint that processes edit_id or dropship_edit_id. The attacker supplies a crafted parameter value containing SQL syntax that alters the executed query. Because authentication is not required, any internet-exposed WordPress site running a vulnerable version can be attacked directly.

No public proof-of-concept exploit or Exploit-DB entry has been published at the time of writing. Full technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13480

Indicators of Compromise

HTTP requests to WordPress admin-ajax or plugin endpoints containing edit_id= or dropship_edit_id= with non-numeric characters such as ', UNION, SELECT, --, or /*
Web server access logs showing repeated requests from a single source enumerating parameter values or table names
Unexpected database errors in PHP or MySQL logs referencing the plugin's query paths
Outbound requests or new administrative users created shortly after suspicious parameter activity

Detection Strategies

Inspect WordPress and web server access logs for URL parameters edit_id and dropship_edit_id containing SQL metacharacters or encoded variants
Deploy web application firewall rules matching common SQL injection patterns targeting these parameter names
Correlate plugin request activity with database error rates to surface blind or time-based injection attempts

Monitoring Recommendations

Enable query logging on MySQL or MariaDB during incident response to identify injected UNION or SLEEP payloads
Alert on unauthenticated requests to plugin endpoints that reference ltl-freight-quotes-fedex-freight-edition
Monitor for creation of new WordPress administrator accounts or modification of wp_options values following suspicious traffic

How to Mitigate CVE-2024-13480

Immediate Actions Required

Update the LTL Freight Quotes – For Customers of FedEx Freight plugin to a version later than 3.4.1 as soon as the vendor publishes a fixed release
If a fixed version is not yet available for your environment, deactivate and remove the plugin until it can be patched
Rotate WordPress administrator passwords and any API keys stored in the database if exploitation is suspected
Review wp_users for unauthorized accounts and audit recent administrative actions

Patch Information

The vendor addressed the SQL injection by hardening parameter handling in the plugin. The corresponding source change is available in the WordPress Plugin Changeset. Administrators should apply the update through the WordPress plugin installer and verify the installed version is greater than 3.4.1.

Workarounds

Block requests containing edit_id or dropship_edit_id parameters with non-integer values at the WAF or reverse proxy layer
Restrict access to WordPress admin endpoints by source IP address where feasible
Cast affected parameters to integers in a custom mu-plugin filter if temporary in-code mitigation is required before patching

bash

# Example ModSecurity rule to block non-numeric values in the vulnerable parameters
SecRule ARGS:edit_id "!@rx ^[0-9]+$" \
    "id:1013480,phase:2,deny,status:403,log,msg:'CVE-2024-13480 SQLi attempt in edit_id'"
SecRule ARGS:dropship_edit_id "!@rx ^[0-9]+$" \
    "id:1013481,phase:2,deny,status:403,log,msg:'CVE-2024-13480 SQLi attempt in dropship_edit_id'"