CVE-2024-13480 is an SQL Injection vulnerability in the enituretechnology LTL Freight Quotes – For Customers of FedEx Freight WordPress plugin, affecting all versions up to and including 3.4.1. The issue arises from improper neutralization of special elements in SQL commands, specifically via the 'edit_id' and 'dropship_edit_id' parameters. These parameters are insufficiently escaped and the SQL queries lack proper preparation, enabling unauthenticated attackers to append malicious SQL code. This can be leveraged to extract sensitive information from the underlying database. The vulnerability has a CVSS 3.1 base score of 7.5 (High), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality but not integrity or availability.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin parameters if possible. Monitor vendor channels for updates and apply any official patches promptly once available.