CVE-2024-13533 is an SQL Injection vulnerability in the Small Package Quotes – USPS Edition plugin for WordPress, affecting all versions up to 1.3.5. The issue arises from improper neutralization of special elements in the 'edit_id' parameter, which is not sufficiently escaped or prepared in SQL queries. This allows unauthenticated attackers to append malicious SQL queries, potentially extracting sensitive data from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. There is no evidence of known exploits in the wild or an available patch at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database without requiring authentication. The vulnerability does not impact integrity or availability according to the CVSS vector, but the confidentiality impact is high. This could compromise sensitive data managed by the plugin's database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to the vulnerable parameter if possible. Monitoring for updates from enituretechnology is recommended to apply any forthcoming patches promptly.