CVE-2024-13481 describes an SQL Injection vulnerability in the enituretechnology LTL Freight Quotes – R+L Carriers Edition WordPress plugin affecting all versions up to 3.3.4. The flaw exists because the 'edit_id' and 'dropship_edit_id' parameters are not properly escaped or prepared before being used in SQL queries. This allows unauthenticated attackers to append malicious SQL commands to existing queries, potentially extracting sensitive data from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable with no privileges or user interaction required, impacting confidentiality but not integrity or availability.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, enabling them to retrieve sensitive information from the database. The impact is limited to confidentiality compromise; there is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor enituretechnology's communications for updates. Until a fix is available, consider restricting access to the affected parameters or disabling the plugin if feasible to reduce exposure.