CVE-2024-13534 Overview
CVE-2024-13534 is a SQL Injection vulnerability affecting the Small Package Quotes – Worldwide Express Edition plugin for WordPress, developed by Eniture. The flaw exists in all versions up to and including 5.2.18. It stems from insufficient escaping of the edit_id and dropship_edit_id parameters and a lack of proper preparation on the existing SQL query. Unauthenticated attackers can append additional SQL statements to existing queries and extract sensitive information from the WordPress database. The issue is tracked under [CWE-89] and is also referenced by the likely duplicate identifier CVE-2025-27268.
Critical Impact
Unauthenticated attackers can extract sensitive data from the WordPress database over the network without user interaction.
Affected Products
- Eniture Small Package Quotes – Worldwide Express Edition plugin for WordPress
- All versions up to and including 5.2.18
- WordPress installations with the affected plugin enabled
Discovery Timeline
- 2025-02-19 - CVE-2024-13534 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13534
Vulnerability Analysis
The vulnerability is a classic SQL Injection [CWE-89] in the Small Package Quotes – Worldwide Express Edition plugin. The plugin accepts the edit_id and dropship_edit_id request parameters and concatenates them into SQL statements without sufficient escaping or parameter binding. Attackers can craft input that breaks out of the intended query context and appends arbitrary SQL clauses. Because no authentication is required, any remote user able to reach the affected WordPress endpoint can attempt exploitation. Successful exploitation enables extraction of database contents, including WordPress user records, password hashes, session tokens, and plugin configuration data.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command. The plugin reads the edit_id and dropship_edit_id values directly from user-controlled input and embeds them into SQL statements. The code does not call $wpdb->prepare() with proper placeholders or apply equivalent escaping through functions such as esc_sql(). As a result, user-supplied SQL fragments are treated as part of the query structure rather than as data.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the affected WordPress site with a malicious payload in the edit_id or dropship_edit_id parameter. The payload typically uses UNION SELECT clauses or boolean and time-based techniques to read arbitrary tables. Information disclosure is the primary impact, consistent with the confidentiality-only impact reflected in the CVSS vector. No verified public exploit code is available at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is published for this vulnerability. Refer to the Wordfence Vulnerability Intelligence entry for further technical context.
Detection Methods for CVE-2024-13534
Indicators of Compromise
- HTTP requests containing SQL meta-characters such as ', UNION, SELECT, SLEEP(, or -- in the edit_id or dropship_edit_id parameters.
- Unexpected outbound responses containing WordPress table data (for example wp_users rows or hashed passwords) originating from plugin endpoints.
- WordPress error log entries referencing malformed SQL queries from the small-package-quotes-wwe-edition plugin path.
Detection Strategies
- Inspect web server and WordPress access logs for requests targeting plugin endpoints with suspicious values in edit_id and dropship_edit_id.
- Deploy web application firewall (WAF) rules that match common SQL Injection patterns against these specific parameters.
- Enable database query logging on MySQL or MariaDB to identify anomalous queries containing UNION, INFORMATION_SCHEMA, or sleep-based payloads.
Monitoring Recommendations
- Monitor for sudden spikes in 500-class responses or unusually long response times tied to the affected plugin URLs, which can indicate blind or time-based SQL Injection probes.
- Alert on repeated requests from a single source IP iterating over edit_id or dropship_edit_id values.
- Track plugin version inventory across all WordPress sites to identify hosts still running 5.2.18 or earlier.
How to Mitigate CVE-2024-13534
Immediate Actions Required
- Update the Small Package Quotes – Worldwide Express Edition plugin to the latest patched release published after version 5.2.18.
- If a patched version is unavailable in your environment, deactivate and remove the plugin until it can be updated.
- Review database logs and WordPress audit trails for evidence of prior exploitation against the edit_id and dropship_edit_id parameters.
Patch Information
The vendor published a fix referenced in the WordPress Plugin Change Log. Site administrators should upgrade to the fixed release through the WordPress plugin updater and verify the installed version no longer reports 5.2.18 or earlier.
Workarounds
- Restrict access to WordPress admin and plugin endpoints using IP allow-listing where the plugin is required for back-office workflows.
- Apply WAF signatures that block SQL Injection payloads in the edit_id and dropship_edit_id parameters until patching is complete.
- Rotate WordPress administrator passwords, session salts, and any API keys stored in the database after patching, in case credentials were exposed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
