CVE-2025-24664: SQL Injection in LTL Freight Quotes

Successful exploitation of this SQL Injection vulnerability could grant an attacker complete control over the database associated with the LTL Freight Quotes plugin. This includes the ability to read, modify, or delete sensitive data such as customer information, shipment details, and financial records. An attacker could potentially gain access to user credentials stored in the database, enabling them to compromise other systems or accounts. The blast radius extends to any system or application that relies on the compromised database, potentially leading to significant data breaches and operational disruptions. While no direct precedent is immediately obvious, SQL Injection vulnerabilities are frequently exploited for data exfiltration and privilege escalation.

1. Reserved2025-01-23
2. Published2025-01-27
3. Modified2026-04-28
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-24664 is to immediately upgrade the LTL Freight Quotes – Worldwide Express Edition plugin to version 5.0.21 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL queries targeting the vulnerable endpoints. Specifically, look for patterns indicative of SQL injection attempts, such as the presence of single quotes, double quotes, semicolons, or SQL keywords in user-supplied input. Additionally, review and restrict database user permissions to limit the potential damage from a successful attack. After upgrading, confirm the fix by attempting a SQL injection attack on the vulnerable endpoint and verifying that it is properly blocked.

Active installs

80Niche

Plugin rating