SQL Injection Vulnerability in LTL Freight Quotes Plugin for WordPress by GlobalTranz

CVE-2024-13476

Summary

The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress has been identified with a vulnerability that allows SQL Injection through the 'engtz_wd_save_dropship' AJAX endpoint. This issue arises from inadequate escaping of user-supplied data and insufficient preparation of SQL queries. Unauthenticated attackers can exploit this flaw, enabling them to inject malicious SQL statements into existing queries, which may lead to unauthorized access to sensitive information stored in the database. Web administrators should ensure that they are operating on updated software versions to mitigate risks associated with this vulnerability.

References