CVE-2024-13479

Summary

CVE-2024-13479 is a newly disclosed SQL Injection vulnerability affecting the LTL Freight Quotes – SEFL Edition plugin for WordPress. The flaw, present in all versions up to 3.2.4, stems from insufficient escaping of user-supplied data in the 'dropship_edit_id' and 'edit_id' parameters. Attackers can exploit this issue by appending malicious SQL queries to existing ones, potentially gaining unauthorized access to sensitive information in the database. Unauthenticated attackers can take advantage of this vulnerability to extract valuable data, posing a significant risk to WordPress sites using the impacted plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.