The LTL Freight Quotes – SAIA Edition WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in the 'edit_id' and 'dropship_edit_id' parameters. These parameters are directly incorporated into SQL queries without sufficient escaping or parameterization, enabling unauthenticated attackers to append malicious SQL code. This vulnerability affects all plugin versions up to 2.2.10. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact primarily on confidentiality. No known exploits in the wild have been reported. No patch or remediation details are provided in the available data.

Successful exploitation allows unauthenticated remote attackers to extract sensitive information from the database by injecting arbitrary SQL commands via vulnerable parameters. The integrity and availability of the system are not impacted according to the CVSS vector. The confidentiality of data is at high risk due to unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.