CVE-2024-1514

Summary

CVE-2024-1514 is a vulnerability affecting the WP eCommerce plugin for WordPress. This issue allows unauthenticated attackers to perform time-based blind SQL Injection attacks through the 'cart_contents' parameter, which stems from insufficient escaping on user-supplied data and an lack of preparation of existing SQL queries. Consequently, adversaries can append additional SQL queries to already established ones, potentially extracting sensitive information from the database. Versions up to and including 3.15.1 are susceptible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.