CVE-2024-13534 describes an SQL Injection vulnerability in the Small Package Quotes – Worldwide Express Edition WordPress plugin. The issue is due to insufficient escaping and lack of proper preparation of the 'edit_id' and 'dropship_edit_id' parameters in SQL queries, enabling unauthenticated attackers to append malicious SQL commands. This can result in unauthorized disclosure of sensitive data from the database. The vulnerability affects all versions up to 5.2.18. No patch or official fix information is available, and the vulnerability is publicly disclosed with a high CVSS score of 7.5.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the plugin's database. The vulnerability does not impact integrity or availability but compromises confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable parameters or disabling the plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.