CVE-2024-13490: LTL Freight Quotes SQLi Vulnerability

CVE-2024-13490 Overview

CVE-2024-13490 is a SQL injection vulnerability in the LTL Freight Quotes – XPO Edition plugin for WordPress. The flaw affects all versions up to and including 4.3.7. Attackers exploit insufficient escaping on the edit_id and dropship_edit_id parameters combined with improper SQL query preparation. Unauthenticated attackers can append additional SQL queries to existing statements and extract sensitive database content. The issue is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets, by injecting SQL through vulnerable plugin parameters.

Affected Products

Eniture LTL Freight Quotes – XPO Edition plugin for WordPress
All plugin versions up to and including 4.3.7
WordPress sites with the plugin installed and active

Discovery Timeline

2025-02-12 - CVE-2024-13490 published to the National Vulnerability Database
2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13490

Vulnerability Analysis

The plugin exposes administrative endpoints that accept the edit_id and dropship_edit_id request parameters. These parameters are concatenated into SQL statements without parameterized query preparation. The plugin also fails to apply sufficient escaping or type casting before passing values to the database layer. An attacker supplies crafted input that terminates the existing query context and appends additional SQL statements. The injected payload runs with the database privileges of the WordPress site, allowing extraction of arbitrary data through UNION-based or stacked query techniques.

Root Cause

The root cause is missing use of the WordPress $wpdb->prepare() API for the edit_id and dropship_edit_id parameters. The plugin treats these values as trusted integers but never enforces type validation. Combined with absent input escaping, this creates a direct path from HTTP request to SQL execution.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the vulnerable endpoint containing a malicious payload in the edit_id or dropship_edit_id parameter. The injected SQL executes against the WordPress database. Refer to the Wordfence Vulnerability Report for additional technical context.

No verified proof-of-concept code is publicly available. The vulnerability
manifests through HTTP parameters edit_id and dropship_edit_id, which are
concatenated into SQL queries without preparation or escaping.

Detection Methods for CVE-2024-13490

Indicators of Compromise

HTTP requests containing SQL syntax such as UNION SELECT, SLEEP(, or ' OR '1'='1 in the edit_id or dropship_edit_id parameters
Unexpected database errors logged by WordPress or MySQL referencing the LTL Freight Quotes plugin tables
Anomalous outbound data transfer following requests to plugin administrative endpoints
Web server access logs showing repeated requests to plugin URLs from a single source IP

Detection Strategies

Inspect WordPress access logs for requests containing encoded SQL metacharacters in the affected parameters
Deploy web application firewall rules that flag SQL injection patterns targeting WordPress plugin endpoints
Correlate database error spikes with HTTP requests reaching the LTL Freight Quotes plugin
Monitor for plugin version 4.3.7 or earlier across managed WordPress installations

Monitoring Recommendations

Enable MySQL general query logging temporarily on at-risk hosts to identify malformed SQL originating from plugin endpoints
Forward WordPress and web server logs to a centralized SIEM for retention and correlation
Alert on HTTP 500 responses generated by plugin URLs, which often indicate failed injection attempts
Track outbound network connections from the WordPress host that follow suspicious inbound requests

How to Mitigate CVE-2024-13490

Immediate Actions Required

Update the LTL Freight Quotes – XPO Edition plugin to a version newer than 4.3.7 immediately
Audit WordPress user accounts and rotate credentials if compromise is suspected
Review database query logs for evidence of prior exploitation attempts
Restrict access to WordPress administrative endpoints using IP allowlisting where feasible

Patch Information

The vendor addressed the vulnerability in a plugin update tracked in the WordPress Changeset 3235163. Administrators should upgrade through the WordPress plugin management interface or by deploying the patched release manually. Verify the running version after the update completes.

Workarounds

Deactivate and remove the LTL Freight Quotes – XPO Edition plugin until the patched version is deployed
Deploy a web application firewall rule that blocks requests containing SQL keywords in the edit_id and dropship_edit_id parameters
Restrict access to the WordPress administration directory using HTTP authentication or network controls
Apply database-level least privilege so the WordPress user cannot read sensitive tables outside its required scope

bash

# Example WAF rule pattern (ModSecurity syntax)
SecRule ARGS:edit_id|ARGS:dropship_edit_id "@rx (?i)(union|select|sleep|benchmark|--|;)" \
  "id:1004913,phase:2,deny,status:403,msg:'CVE-2024-13490 SQLi attempt'"