CVE-2024-13531: 
WordPress vulnerability analysis and mitigation

The ShipEngine Shipping Quotes plugin for WordPress contains an SQL Injection vulnerability (CVE-2024-13531) discovered in versions up to and including 1.0.7. The vulnerability was disclosed on February 11, 2025, and affects the plugin's handling of the 'edit_id' parameter (NVD).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries. The issue specifically involves the 'edit_id' parameter, which allows for SQL query manipulation. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with no required privileges or user interaction (Wordfence).

The vulnerability allows unauthenticated attackers to append additional SQL queries to existing queries, potentially leading to the extraction of sensitive information from the database (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack vector is accessible over the network, making it relatively straightforward to exploit (Wordfence).

Users should upgrade to a version newer than 1.0.7 when available. The vulnerability has been identified in the shipping-rules-save.php file (WordPress Plugin).