CVE-2024-13477 is a high severity (CVSS 7.5) SQL injection in the LTL Freight Quotes Unishippers Edition plugin for WordPress, through the edit_id parameter, in versions up to and including 2.5.8. Unauthenticated attackers can read database data. Update past 2.5.8 or remove it.
What's affected
- LTL Freight Quotes, Unishippers Edition, all versions up to and including 2.5.8.
- The injectable value is the edit_id parameter.
The record does not name a fixed version, but it links a code changeset. Check the plugin page for a release newer than 2.5.8.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i freight
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the plugin to a release newer than 2.5.8.
- If you do not ship by freight, deactivate and delete it.
- Review database users and secrets stored in tables that the web application can read.
- Look up CVE-2024-13477 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record points at the shipping rules save code, where edit_id is placed into a query without proper escaping or preparation. An unauthenticated visitor can append SQL and read data.
Shipping plugins on WooCommerce sites handle customer addresses, so the impact is personal data exposure. Sites with a plugin installed but unused are especially likely to miss this, so list installed plugins as well as active ones.
This CVE is an SQL injection flaw (CWE-89, SQL Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
SQL injection happens when user input is placed into a database query as if it were part of the query itself. The database cannot tell which parts were written by the developer and which were supplied by a visitor, so it runs both.
The standard cure is prepared statements with bound parameters, plus escaping and validation as a second layer. The record points at missing escaping and missing query preparation, which is the usual pattern. Here the confidentiality impact is high and integrity and availability are not affected in the CVSS vector, so the main concern is data leaving the database: user records, order data and stored secrets.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the plugin affected if deactivated?
A deactivated plugin does not run, but it is better to delete plugins you do not use.
Does it change data?
The vector shows no integrity impact, only confidentiality.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
