CVE-2024-13491: Eniture Package Quotes SQLi Vulnerability

CVE-2024-13491 Overview

CVE-2024-13491 is a SQL Injection vulnerability [CWE-89] in the Small Package Quotes – For Customers of FedEx plugin for WordPress, developed by Eniture. The flaw affects all versions up to and including 4.3.1. The edit_id and dropship_edit_id parameters lack sufficient escaping, and the underlying SQL queries are not properly prepared. Unauthenticated attackers can append SQL syntax to existing queries and extract sensitive data from the WordPress database.

Critical Impact
Unauthenticated remote attackers can execute SQL injection over the network without user interaction, exposing credentials, customer records, and other sensitive database content.

Affected Products

Eniture Small Package Quotes – For Customers of FedEx (WordPress plugin)
Versions <= 4.3.1
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-02-19 - CVE-2024-13491 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13491

Vulnerability Analysis

The plugin accepts the edit_id and dropship_edit_id HTTP parameters and concatenates their values directly into SQL statements. Because the values are not cast, escaped, or passed through $wpdb->prepare(), an attacker can break out of the intended query context. Appended SQL syntax executes against the WordPress database with the same privileges as the plugin's database user, typically full read access to all WordPress tables including wp_users and wp_usermeta.

The vulnerability is exploitable without authentication, meaning any visitor able to reach the vulnerable endpoint can trigger it. Exploitation primarily impacts confidentiality, enabling extraction of password hashes, session tokens, customer data, and FedEx API credentials stored by the plugin.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin treats user-supplied edit_id and dropship_edit_id values as trusted integers and inserts them into queries through string concatenation. WordPress provides $wpdb->prepare() and absint() for safe handling, but neither is applied on the vulnerable code path.

Attack Vector

Attackers craft HTTP requests targeting the plugin endpoints that consume edit_id or dropship_edit_id. By supplying a payload containing UNION SELECT or boolean-based logic, the attacker can exfiltrate database contents row by row, or use time-based techniques such as SLEEP() for blind extraction. No authentication, privileges, or user interaction are required.

A conceptual request pattern targets the vulnerable parameter with appended SQL syntax such as UNION SELECT user_login, user_pass FROM wp_users. See the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for technical details on the vulnerable code path and the applied fix.

Detection Methods for CVE-2024-13491

Indicators of Compromise

HTTP requests containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA within the edit_id or dropship_edit_id parameters.
Web server access logs showing repeated requests to plugin endpoints with incrementing or encoded numeric values in those parameters.
Unexpected database errors logged by WordPress or MySQL referencing the small-package-quotes-fedex-edition plugin paths.
Outbound connections from the web host to attacker infrastructure shortly after suspicious plugin requests.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that blocks SQL metacharacters and keywords in edit_id and dropship_edit_id query string and POST parameters.
Enable MySQL general query logging temporarily and alert on queries referencing wp_users originating from the plugin's PHP files.
Correlate WordPress debug.log entries with web access logs to identify malformed queries tied to the plugin.

Monitoring Recommendations

Monitor authentication anomalies such as logins from new geographies that follow probing of the plugin endpoints.
Alert on bulk row reads from wp_users, wp_usermeta, and any plugin-specific tables storing FedEx API keys.
Track plugin inventory across WordPress sites and flag installations still running version 4.3.1 or earlier.

How to Mitigate CVE-2024-13491

Immediate Actions Required

Update the Small Package Quotes – For Customers of FedEx plugin to the latest version above 4.3.1 immediately.
Audit the WordPress database for signs of unauthorized reads, and rotate administrator passwords and any FedEx API credentials stored by the plugin.
Invalidate active WordPress sessions by changing the AUTH_KEY and related salts in wp-config.php.
Review web server logs for the past activity referencing the vulnerable parameters and investigate any matches.

Patch Information

The vendor addressed the issue in the WordPress plugin repository. See the WordPress Plugin Changeset for the committed fix, which adds proper escaping and prepared statement handling for the affected parameters. Administrators should upgrade through the WordPress plugin update mechanism to receive the patched release.

Workarounds

If immediate patching is not possible, deactivate and remove the Small Package Quotes – For Customers of FedEx plugin until it can be updated.
Add a WAF or ModSecurity rule that rejects requests where edit_id or dropship_edit_id contain non-numeric characters.
Restrict access to WordPress admin and plugin endpoints by IP allowlisting at the reverse proxy or hosting layer.

bash

# Example ModSecurity rule to enforce numeric-only values
SecRule ARGS:edit_id|ARGS:dropship_edit_id "!@rx ^[0-9]+$" \
    "id:1009101,phase:2,deny,status:403,log,\
     msg:'CVE-2024-13491: Non-numeric value in edit_id/dropship_edit_id'"