Cyber Resilience

CVE-2024-13488

High

Published: 15 February 2025

Published
15 February 2025
Modified
28 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.1508 94.7th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13488 is a high-severity SQL Injection (CWE-89) vulnerability in Enituretechnology Ltl Freight Quotes. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to and including 3.3.7. The issue arises from insufficient escaping of user-supplied input combined with a lack of prepared statements on existing SQL queries, corresponding to CWE-89 and carrying a CVSS 3.1 score of 7.5.

Unauthenticated attackers can exploit the flaw remotely by supplying crafted values to the affected parameters, allowing them to append arbitrary SQL to existing queries and extract sensitive data from the database.

The referenced Wordfence advisory and WordPress plugin trac changesets document the vulnerable code paths and the availability of a patched version that resolves the injection vectors.

EPSS reached a peak of 0.1819 against a current value of 0.1508, reflecting a moderate rise in observed exploitation interest after disclosure.

EU & UK References

Vulnerability details

The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack…

more

of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct unauthenticated SQL injection in a public-facing WordPress plugin enables remote exploitation of the web application to extract database contents.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-13531Same vendor: Enituretechnology
CVE-2026-39334Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

enituretechnology
ltl freight quotes
≤ 3.3.8

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of user-supplied inputs like 'dropship_edit_id' and 'edit_id' to prevent SQL injection by ensuring sufficient escaping and preparation of SQL queries.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely identification, reporting, and correction of flaws such as the SQL injection vulnerability in the plugin code.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

RA-5 involves vulnerability scanning that can identify SQL injection flaws in WordPress plugins like LTL Freight Quotes – Estes Edition.

References