CVE-2024-13533
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Feb 19, 2025
Updated: Feb 25, 2025
CWE ID 89
Summary
CVE-2024-13533: The Small Package Quotes – USPS Edition plugin for WordPress contains a SQL Injection vulnerability. Unauthenticated attackers can exploit this issue by injecting malicious SQL queries via the 'edit_id' parameter. The plugin fails to properly escape user-supplied data and does not adequately prepare existing SQL queries, allowing attackers to extract sensitive information from the database. WordPress users should update to the latest version of the plugin to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Share