CVE-2024-13531: ShipEngine Shipping Quotes SQLi Flaw

CVE-2024-13531 Overview

CVE-2024-13531 is a SQL Injection vulnerability affecting the ShipEngine Shipping Quotes plugin for WordPress, developed by Enituretechnology. The flaw exists in all versions up to and including 1.0.7. The plugin fails to properly escape the edit_id parameter and does not use sufficient query preparation, allowing unauthenticated attackers to inject additional SQL statements into existing queries. Successful exploitation enables extraction of sensitive information from the underlying WordPress database, including user credentials and configuration data. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can exfiltrate database contents from affected WordPress sites by appending SQL queries through the edit_id parameter.

Affected Products

Enituretechnology ShipEngine Shipping Quotes plugin for WordPress (all versions ≤ 1.0.7)
WordPress installations with the vulnerable plugin activated
Sites exposing the plugin's edit_id parameter to unauthenticated requests

Discovery Timeline

2025-02-12 - CVE-2024-13531 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13531

Vulnerability Analysis

The vulnerability resides in the ShipEngine Shipping Quotes plugin's handling of the edit_id HTTP parameter. The plugin reads edit_id from user input and concatenates it directly into a SQL query without applying esc_sql() sanitization or using $wpdb->prepare() with parameterized placeholders. Because the affected endpoint is reachable without authentication, any remote attacker can inject SQL syntax. The injected SQL executes within the WordPress database user context, granting read access to tables such as wp_users and wp_options. Attackers commonly use UNION-based or time-based blind techniques to enumerate schema contents and extract password hashes, session tokens, and secret keys.

Root Cause

The root cause is insufficient input neutralization on the edit_id parameter combined with the absence of prepared statements. The plugin treats the parameter as a trusted integer but never casts or validates it, allowing string-based SQL payloads to pass through to the database driver. WordPress provides the $wpdb->prepare() API specifically to prevent this class of issue, and the vulnerable code path does not use it.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the plugin endpoint that processes edit_id, supplying a crafted payload such as a UNION SELECT or boolean-based blind injection string. The vulnerable query executes the injected SQL, and the attacker reads results from the HTTP response or infers them through timing differences. Refer to the Wordfence Vulnerability Report and the WordPress Changeset Update for technical details on the vulnerable code path and the fix.

Detection Methods for CVE-2024-13531

Indicators of Compromise

HTTP requests containing the edit_id parameter with SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment markers (--, #)
Web server access logs showing repeated requests to ShipEngine Shipping Quotes plugin endpoints from a single IP with varying edit_id values
Database error messages in PHP logs referencing syntax errors triggered near the edit_id value
Unexpected outbound database query latency consistent with time-based blind SQL injection

Detection Strategies

Inspect web application firewall (WAF) logs for SQL injection signatures targeting WordPress plugin parameters, specifically edit_id
Correlate WordPress wp-content/plugins/shipengine-shipping-quotes/ access patterns with anomalous query strings
Enable MySQL general query logging temporarily during incident response to identify malformed queries originating from the plugin

Monitoring Recommendations

Monitor for unauthenticated POST and GET requests to plugin admin-ajax handlers referencing edit_id
Alert on spikes in 500-series HTTP responses from URLs containing the plugin path, which often indicate failed injection attempts
Track changes to WordPress administrative accounts and option values that could result from post-exploitation activity

How to Mitigate CVE-2024-13531

Immediate Actions Required

Update the ShipEngine Shipping Quotes plugin to a version newer than 1.0.7 that includes the fix from WordPress changeset 3241894
If a patched version is not yet available for your environment, deactivate and remove the plugin until it can be updated
Rotate WordPress secret keys in wp-config.php and force password resets for administrative accounts if exploitation is suspected
Review database logs and audit wp_users table activity to identify potential data exfiltration

Patch Information

The vendor addressed the vulnerability in the WordPress.org plugin repository via changeset 3241894. The fix introduces proper preparation of SQL queries using $wpdb->prepare() with parameterized placeholders for the edit_id parameter. Administrators should upgrade through the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository.

Workarounds

Deploy a WAF rule blocking requests where the edit_id parameter contains SQL keywords or non-numeric characters
Restrict access to the plugin's endpoints by IP allowlist at the web server level until patching is complete
Disable the ShipEngine Shipping Quotes plugin entirely if shipping quote functionality is not actively required

bash

# Example ModSecurity rule to block non-numeric edit_id values
SecRule ARGS:edit_id "!@rx ^[0-9]+$" \
    "id:1013531,phase:2,deny,status:403,\
    msg:'CVE-2024-13531: Non-numeric edit_id parameter blocked'"