Time-Based SQL Injection Vulnerability in FV Flowplayer Video Player

CVE-2024-6338

Summary

The FV Flowplayer Video Player plugin for WordPress is susceptible to a time-based SQL Injection vulnerability. This issue exists due to improper handling of the ‘exclude’ parameter, where the lack of sufficient escaping on user-supplied data allows attackers with Subscriber-level access or higher to inject additional SQL queries. This exploitation could lead to unauthorized access and extraction of sensitive data from the database, posing a significant risk to affected WordPress installations. It is imperative for site administrators to update to the latest plugin version to mitigate this risk.

References