CVE-2024-1514 is a critical (CVSS 9.8) time-based blind SQL injection in the WP eCommerce plugin for WordPress, versions up to and including 3.15.1. Unauthenticated attackers can append SQL through the cart_contents parameter to extract data from the database. Update to a release newer than 3.15.1, or remove the plugin.
What's affected
The record says all versions of the WP eCommerce plugin up to and including 3.15.1 are affected. The record names no fixed version. Its references are a line of plugin source code and a Wordfence entry, which I did not retrieve.
Check the plugin's changelog on WordPress.org for the first release after 3.15.1. If the plugin has no newer release, treat the site as exposed and plan to remove the plugin or replace the store.
No login is needed to reach the vulnerable parameter, so every internet-facing store running the plugin is in scope.
How to check if you're exposed
List the plugin version with WP-CLI:
wp plugin list --name=wp-e-commerce --fields=name,status,version
A version at or below 3.15.1 is affected. Also look in your web server and database logs for requests with unusually slow responses on cart pages, because time-based blind injection works by measuring delays.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the plugin version on every WordPress site you run.
- Update to the first release after 3.15.1, or deactivate and remove the plugin if none exists.
- Put a web application firewall rule in front of the cart endpoints as a stop gap.
- Review database accounts used by WordPress and remove privileges it does not need.
- Rotate administrator passwords and review user accounts if you saw suspicious traffic.
Why it matters
The record classes this as CWE-89, SQL injection. A request parameter was placed into a query without enough escaping and without a prepared statement, so the attacker's text became part of the SQL.
Blind injection is slower than the visible kind, but it still reads the whole database, including customer records and password hashes. For a shop this means personal and order data. The score of 9.8 reflects network access, no privileges and no user interaction. The record's KEV flag is false.
Quick check
Do attackers need an account?
No. The record says unauthenticated attackers can use it.
What does time-based blind mean?
The attacker learns data by watching how long responses take, rather than reading query results directly.
Sources
- Wordfence vulnerability entry (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1514
Last reviewed: 19 October 2026.
