CVE-2024-1061 Scanner

WordPress HTML5 Video Player is a plugin designed to embed and manage HTML5 videos on WordPress websites. Developed for administrators and content creators, it enhances user experience by providing seamless integration of video content. However, the plugin is susceptible to SQL Injection attacks, which can be exploited by unauthenticated attackers to compromise the security of WordPress sites.

The vulnerability detected in WordPress HTML5 Video Player revolves around SQL Injection, enabling attackers to inject malicious SQL queries via the plugin's REST API endpoints. With this vulnerability, unauthenticated attackers can manipulate database queries to extract sensitive information or perform unauthorized actions on the WordPress site.

The SQL Injection vulnerability in WordPress HTML5 Video Player is triggered through crafted GET requests to the '/?rest_route=/h5vp/v1/view/1' endpoint. By appending specially crafted SQL payloads to the 'id' parameter, attackers can execute arbitrary SQL commands, potentially leading to unauthorized data access or manipulation.

Exploiting the SQL Injection vulnerability in WordPress HTML5 Video Player can result in severe consequences, including unauthorized access to sensitive data stored in the WordPress database, data leakage, and potential compromise of the entire WordPress site. Attackers can extract user credentials, manipulate content, or even escalate privileges, posing significant risks to website integrity and user privacy.

Enhance your WordPress website's security posture and protect against SQL Injection vulnerabilities with the comprehensive scanning capabilities offered by the securityforeveryone platform. Join our platform to proactively identify and remediate vulnerabilities like CVE-2024-1061, ensuring the resilience and security of your WordPress site against potential cyber threats.

References:

• https://www.tenable.com/security/research/tra-2024-02
• https://wordpress.org/plugins/html5-video-player
• https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1061