CVE-2024-13531

Summary

CVE-2024-13531: A vulnerability in the ShipEngine Shipping Quotes plugin for WordPress allows unauthenticated attackers to inject SQL queries through the 'edit_id' parameter. This issue arises due to insufficient escaping of user-supplied data and inadequate preparation of existing SQL queries. Consequently, attackers can append malicious queries to extract sensitive information from the database. WordPress users are advised to update the plugin as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.