CVE-2024-13489 describes an SQL Injection vulnerability (CWE-89) in the enituretechnology LTL Freight Quotes – Old Dominion Edition WordPress plugin. The vulnerability arises from insufficient escaping and lack of proper query preparation for the 'edit_id' and 'dropship_edit_id' parameters. This allows unauthenticated remote attackers to append malicious SQL queries to existing database queries, potentially exposing sensitive information. The vulnerability affects all versions up to 4.2.10. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector. There are no reports of active exploitation in the wild. The attack can be performed remotely without authentication, increasing the risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable plugin parameters if possible to reduce exposure.