CVE-2024-13481: Eniture LTL Freight Quotes SQLi Flaw

CVE-2024-13481 Overview

CVE-2024-13481 is an unauthenticated SQL Injection vulnerability in the LTL Freight Quotes – R+L Carriers Edition plugin for WordPress. The flaw affects all versions of the plugin up to and including 3.3.4. Attackers can inject arbitrary SQL through the edit_id and dropship_edit_id parameters because the plugin fails to escape user input and does not properly prepare the SQL query. Exploitation allows extraction of sensitive data from the WordPress database without authentication. The issue is tracked under CWE-89 and was patched by the vendor eniture via a WordPress plugin changeset.

Critical Impact
Unauthenticated attackers can extract sensitive database contents — including user credentials, session tokens, and configuration data — by appending SQL statements to vulnerable query parameters.

Affected Products

Eniture LTL Freight Quotes – R+L Carriers Edition for WordPress, all versions up to and including 3.3.4
WordPress sites running the eniture:ltl_freight_quotes plugin in the R+L Carriers configuration
Any e-commerce stores integrating the plugin for freight quote functionality

Discovery Timeline

2025-02-19 - CVE-2024-13481 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13481

Vulnerability Analysis

The vulnerability resides in request handlers that consume the edit_id and dropship_edit_id parameters. The plugin concatenates these values directly into SQL statements executed against the WordPress database. Because the parameters accept any input from unauthenticated HTTP requests, an attacker can break out of the intended query context and append additional clauses. The result is a classic in-band or union-based SQL Injection that exposes arbitrary table contents to the attacker.

The plugin is widely deployed on WooCommerce-based shipping integrations, increasing the attack surface across e-commerce environments. Because exploitation requires no authentication and no user interaction, the vulnerability can be reached by anonymous internet traffic. The current EPSS probability is 0.868%, reflecting active scanner interest in WordPress plugin SQLi vulnerabilities.

Root Cause

The root cause is insufficient input escaping combined with absent prepared statement usage. The plugin does not invoke WordPress's $wpdb->prepare() with parameterized placeholders for the edit_id and dropship_edit_id values. It also does not sanitize the inputs with absint() or sanitize_text_field() before query construction. This violates standard WordPress secure database access guidelines and is consistent with CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

An unauthenticated attacker issues an HTTP request to the vulnerable plugin endpoint with a crafted edit_id or dropship_edit_id parameter. The payload appends SQL syntax — commonly UNION SELECT clauses or conditional time delays — to the existing query. The injected statement executes within the WordPress database context and returns sensitive records such as wp_users credentials or session metadata. See the Wordfence Vulnerability Report for technical details on the affected parameters and exploitation conditions.

Detection Methods for CVE-2024-13481

Indicators of Compromise

HTTP requests containing SQL keywords such as UNION, SELECT, SLEEP, or -- within the edit_id or dropship_edit_id parameter values
Web server access logs showing anomalous query strings targeting plugin admin-ajax or REST endpoints from unauthenticated sources
Unexpected database errors or query timeouts in WordPress debug logs correlated with plugin endpoints
Outbound DNS or HTTP callbacks originating from the WordPress host immediately after suspicious plugin requests

Detection Strategies

Deploy a web application firewall rule that inspects edit_id and dropship_edit_id parameters for SQL metacharacters and union-based payloads
Enable WordPress query logging or SAVEQUERIES in staging to identify malformed queries originating from the plugin
Correlate HTTP 200 responses to plugin endpoints with unusually large response payloads, which can indicate successful data extraction

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for behavioral baselining of plugin parameter values
Alert on repeated requests to plugin endpoints from a single IP exceeding a low-volume threshold within short time windows
Monitor database user activity for wp_users table reads originating from the web application service account outside normal patterns

How to Mitigate CVE-2024-13481

Immediate Actions Required

Update the LTL Freight Quotes – R+L Carriers Edition plugin to a version newer than 3.3.4 that incorporates the fix from WordPress Changeset 3241903
If a patched version cannot be applied immediately, deactivate and remove the plugin from production WordPress installations
Rotate WordPress administrator credentials, API keys, and any secrets stored in the database after confirming patch deployment
Review web server and database logs for evidence of prior exploitation against the vulnerable parameters

Patch Information

The vendor eniture resolved the vulnerability in the WordPress plugin repository via Changeset 3241903. Administrators should upgrade to the latest plugin release available through the WordPress plugin directory. Refer to the Wordfence Vulnerability Report for fixed version details.

Workarounds

Configure a WAF rule to block requests where edit_id or dropship_edit_id contain non-numeric characters
Restrict access to WordPress admin and AJAX endpoints used by the plugin to authenticated administrative IP ranges
Apply database-level least privilege by ensuring the WordPress database user cannot read tables unrelated to the plugin's function

bash

# Example WAF rule (ModSecurity) to block non-numeric edit_id values
SecRule ARGS:edit_id "!@rx ^[0-9]+$" \
  "id:1004813,phase:2,deny,status:403,\
   msg:'CVE-2024-13481 SQLi attempt in edit_id parameter'"

SecRule ARGS:dropship_edit_id "!@rx ^[0-9]+$" \
  "id:1004814,phase:2,deny,status:403,\
   msg:'CVE-2024-13481 SQLi attempt in dropship_edit_id parameter'"