CVE-2024-13533 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2024-13533?

CVE-2024-13533 has a CVSS score of 7.5 (HIGH). This vulnerability allows unauthenticated attackers to perform SQL injection attacks on WordPress sites using the Small Package Quotes – USPS Edition plugin. Attackers can extract sensitive information from the database by manipulating the 'edit_id' parameter. All WordPress sites with this plugin version 1.3.5 or earlier are affected.

📋 TL;DR

This vulnerability allows unauthenticated attackers to perform SQL injection attacks on WordPress sites using the Small Package Quotes – USPS Edition plugin. Attackers can extract sensitive information from the database by manipulating the 'edit_id' parameter. All WordPress sites with this plugin version 1.3.5 or earlier are affected.

💻 Affected Systems

Products:

Small Package Quotes – USPS Edition WordPress Plugin

Versions: All versions up to and including 1.3.5

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with this plugin enabled are vulnerable regardless of configuration.

📦 What is this software?

Small Package Quotes by Eniture

View all CVEs affecting Small Package Quotes →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of user credentials, sensitive site data, and potential privilege escalation leading to full site takeover.

🟠

Likely Case

Data exfiltration of sensitive information stored in the WordPress database, including user data, plugin settings, and potentially other site content.

🟢

If Mitigated

Limited impact with proper input validation and parameterized queries preventing successful injection.

🌐 Internet-Facing: HIGH - The vulnerability is exploitable by unauthenticated attackers via web requests, making all affected sites publicly vulnerable.

🏢 Internal Only: LOW - The vulnerability requires web access to the WordPress site, so internal-only systems are less exposed unless they have web interfaces.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is straightforward to exploit as it requires only web access and manipulation of a single parameter.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 1.3.5

Vendor Advisory: https://plugins.trac.wordpress.org/browser/small-package-quotes-usps-edition/trunk/admin/tab/shipping-rules/shipping-rules-save.php#L77

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find 'Small Package Quotes – USPS Edition'. 4. Click 'Update Now' if available. 5. If no update available, deactivate and delete the plugin immediately.

🔧 Temporary Workarounds

Disable vulnerable endpoint

all

Block access to the vulnerable shipping-rules-save.php file via web server configuration

# For Apache: Add to .htaccess
<Files "shipping-rules-save.php">
    Order allow,deny
    Deny from all
</Files>
# For Nginx: Add to server block
location ~* /admin/tab/shipping-rules/shipping-rules-save\.php$ {
    deny all;
    return 403;
}

🧯 If You Can't Patch

Immediately deactivate and remove the plugin from all WordPress installations
Implement web application firewall (WAF) rules to block SQL injection patterns targeting the edit_id parameter

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Small Package Quotes – USPS Edition. If version is 1.3.5 or lower, you are vulnerable.

Check Version:

# In WordPress admin: Plugins page shows version
# Or check file: wp-content/plugins/small-package-quotes-usps-edition/readme.txt

Verify Fix Applied:

After update, verify plugin version is higher than 1.3.5 in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in WordPress/database logs
Multiple requests to /wp-content/plugins/small-package-quotes-usps-edition/admin/tab/shipping-rules/shipping-rules-save.php with edit_id parameter manipulation
Database error messages containing SQL syntax

Network Indicators:

HTTP POST requests to shipping-rules-save.php with SQL injection payloads in edit_id parameter
Unusual database connection patterns from web server

SIEM Query:

source="web_logs" AND uri="*shipping-rules-save.php*" AND (query="*edit_id=*UNION*" OR query="*edit_id=*SELECT*" OR query="*edit_id=*INSERT*")

📊 Metadata

CVE ID: CVE-2024-13533

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-89

EPSS Score: 0.6% exploit probability (68.9th percentile)

Published: February 19, 2025

Last Updated: February 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-13533, you might also want to check these: