Eniture LTL Freight Quotes: Unauthenticated SQL Injection (CVE-2024-13489)
The Eniture LTL Freight Quotes - Old Dominion Edition WordPress plugin (versions 4.2.10 and below) is vulnerable to unauthenticated SQL injection via the 'edit_id' and 'dropship_edit_id' parameters. Public exploit code is available on Sploitus.
CVE search metadata
CVE search record: CVE-2024-13489. Severity: high. CVSS: 7.5. EPSS: 0.79%. KEV: no. Product: LTL Freight Quotes – Old Dominion Edition (<= 4.2.10). Brief: Eniture LTL Freight Quotes: Unauthenticated SQL Injection (CVE-2024-13489). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2024-13489-sqli/
Triage facts
Revision 1- Applicability
- LTL Freight Quotes – Old Dominion Edition (<= 4.2.10)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 29, 01:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
The LTL Freight Quotes - Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection in versions 4.2.10 and below. This is caused by insufficient escaping on user-supplied parameters and a lack of sufficient preparation on the existing SQL query. Unauthenticated attackers can append additional SQL queries to extract sensitive information. Public exploit proof-of-concept code is available.