The WP Marka WordPress Auction Plugin (wp-auctions) versions up to 3.7 contain an SQL Injection vulnerability (CVE-2024-51615) caused by improper neutralization of special elements in SQL commands. This allows remote attackers to execute arbitrary SQL queries without authentication or user interaction, potentially leading to unauthorized data disclosure. The vulnerability is rated critical with a CVSS 3.1 base score of 9.3, reflecting its ease of exploitation and impact on confidentiality. No vendor advisory or patch information is currently available, and the plugin is not a cloud service.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the affected WordPress site's database, leading to unauthorized disclosure of sensitive information. The CVSS vector indicates a high confidentiality impact, no integrity impact, and low availability impact. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the WP Marka WordPress Auction Plugin if it is in use, or restrict access to the plugin functionality to trusted users only. Monitor official WP Marka communications for updates and patches addressing this vulnerability.