CVE-2024-13532: Eniture Small Package Quotes SQLi Flaw

CVE-2024-13532 Overview

CVE-2024-13532 is an unauthenticated SQL injection vulnerability in the Small Package Quotes – Purolator Edition plugin for WordPress, developed by Eniture. The flaw affects all plugin versions up to and including 3.6.4. The vulnerability exists in the edit_id and dropship_edit_id parameters, which the plugin fails to escape and does not include in properly prepared SQL statements. Attackers can append arbitrary SQL clauses to existing queries to extract sensitive database content. The weakness is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive data such as user credentials, session tokens, and WordPress secrets from the backend database.

Affected Products

Eniture Small Package Quotes – Purolator Edition plugin for WordPress, all versions through 3.6.4
WordPress sites using the plugin's edit_id request parameter handler
WordPress sites using the plugin's dropship_edit_id request parameter handler

Discovery Timeline

2025-02-12 - CVE-2024-13532 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-13532

Vulnerability Analysis

The plugin builds SQL queries by concatenating user-controlled input from the edit_id and dropship_edit_id HTTP parameters. The code does not call wpdb::prepare() with proper placeholders and does not sanitize the input with esc_sql() or cast it to an integer. As a result, attacker-supplied SQL syntax is interpreted as part of the original query.

Because the endpoints accepting these parameters do not require authentication, the attack surface is exposed to any remote client able to reach the WordPress site. The vulnerability supports data exfiltration through UNION-based or boolean/time-based blind injection techniques. Successful exploitation allows reading any table accessible by the WordPress database user, including wp_users (password hashes) and wp_options (site secrets, API keys).

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin trusts the request parameters and inlines their string value into the SQL statement rather than binding them as parameters through the WordPress database abstraction layer.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint, supplying SQL syntax in the edit_id or dropship_edit_id parameter. The injected payload appends additional clauses, such as UNION SELECT, to the original query and returns or infers data from the database response. No special privileges, tokens, or victim interaction are required. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Change Log for technical details on the affected code paths.

Detection Methods for CVE-2024-13532

Indicators of Compromise

HTTP requests containing SQL meta-characters such as ', UNION, SELECT, SLEEP(, or -- in the edit_id or dropship_edit_id query parameter.
Unexpected outbound responses with unusually large payload sizes from plugin endpoints, indicating data exfiltration through UNION-based injection.
WordPress error log entries showing malformed SQL queries referencing the Purolator plugin handlers.
New or unknown administrator accounts created after suspicious requests to the plugin endpoints.

Detection Strategies

Inspect web server access logs for requests targeting the plugin where edit_id or dropship_edit_id values are non-numeric.
Deploy web application firewall rules that block SQL injection patterns targeting these specific parameter names.
Monitor database query logs for queries originating from the plugin that contain UNION, INFORMATION_SCHEMA, or stacked statements.

Monitoring Recommendations

Enable WordPress debug logging and forward logs to a centralized SIEM for correlation with web traffic.
Alert on anomalous response latencies from plugin endpoints, which may indicate time-based blind SQL injection probing.
Track baseline request volume to the affected endpoints and flag spikes from single source IP addresses.

How to Mitigate CVE-2024-13532

Immediate Actions Required

Disable or remove the Small Package Quotes – Purolator Edition plugin until a vendor-supplied patched build is confirmed deployed.
Restrict access to WordPress admin and plugin endpoints behind a WAF with SQL injection signatures enabled.
Audit the wp_users and wp_options tables for unauthorized modifications and rotate any secrets stored in the database.
Review web server logs covering the period since plugin installation for prior exploitation attempts.

Patch Information

No vendor advisory URL is published in the NVD record for this CVE. Site administrators should consult the WordPress Plugin Change Log for the fix commit and upgrade to a release later than 3.6.4 once available from the Eniture vendor.

Workarounds

Block HTTP requests where edit_id or dropship_edit_id parameters contain non-integer values using WAF or reverse proxy rules.
Restrict the plugin's PHP endpoints to authenticated administrator IP ranges through web server access control lists.
Apply database account least privilege by limiting the WordPress database user to only the tables the application requires.

bash

# Example ModSecurity rule blocking non-numeric values in vulnerable parameters
SecRule ARGS:edit_id|ARGS:dropship_edit_id "!@rx ^[0-9]+$" \
    "id:1013532,phase:2,deny,status:403,\
    msg:'CVE-2024-13532 SQLi attempt in Purolator plugin parameter'"