CVE-2024-1514 is a critical SQL Injection vulnerability in the WP eCommerce WordPress plugin (versions up to 3.15.1). The issue arises from improper neutralization of special elements in the 'cart_contents' parameter, allowing unauthenticated attackers to append additional SQL commands to existing queries. This vulnerability enables time-based blind SQL Injection attacks that can be used to extract sensitive data from the backend database. The vulnerability is due to insufficient escaping and lack of prepared statements in the affected code paths.

Successful exploitation of this vulnerability can lead to full compromise of the database confidentiality, integrity, and availability. Attackers can extract sensitive information without authentication, potentially leading to data breaches and further system compromise. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the WP eCommerce plugin if possible or apply any available temporary mitigations from the vendor. Monitoring for updates from the plugin author or WordPress security advisories is essential to apply an official fix once released.