CVE-2024-5522 Overview
CVE-2024-5522 is an unauthenticated SQL injection vulnerability in the HTML5 Video Player WordPress plugin developed by bplugins. The plugin fails to sanitize and escape a parameter received through a REST route before incorporating it into a SQL statement. Attackers can send crafted requests to the vulnerable REST endpoint and execute arbitrary SQL queries against the WordPress database. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and affects all plugin versions prior to 2.5.27.
Critical Impact
Unauthenticated attackers can extract sensitive database contents, including user credentials and session data, from any WordPress site running a vulnerable version of the plugin.
Affected Products
- Bplugins HTML5 Video Player for WordPress versions prior to 2.5.27
- WordPress installations exposing the plugin's REST route to unauthenticated requests
- Sites where the plugin is installed but deactivated may still expose REST endpoints depending on configuration
Discovery Timeline
- 2024-06-20 - CVE-2024-5522 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-5522
Vulnerability Analysis
The HTML5 Video Player plugin registers a REST API route that accepts user-controlled input. This input is passed directly into a SQL query without proper sanitization or parameter binding. Because the REST route does not require authentication, any remote attacker can reach the vulnerable code path over the network.
SQL injection [CWE-89] in this context enables direct manipulation of database queries. Attackers can extract data using UNION-based techniques, boolean-based blind extraction, or time-based blind extraction depending on how the query response is rendered. The attack requires no user interaction and no privileges on the target system.
Root Cause
The root cause is the absence of input sanitization and prepared statements in a REST endpoint handler. The plugin passes a request parameter directly into a SQL string, concatenating attacker-controlled data into the query. WordPress provides the wpdb->prepare() function specifically to prevent this class of flaw, and its omission enables injection.
Attack Vector
Exploitation occurs over the network against the WordPress REST API. An unauthenticated attacker sends an HTTP request to the vulnerable REST route with a malicious parameter value containing SQL syntax. The plugin executes the injected SQL against the WordPress database, returning data through the response or via inference from response timing and status.
No verified public proof-of-concept code is available. For technical specifics, refer to the WPScan Vulnerability Advisory.
Detection Methods for CVE-2024-5522
Indicators of Compromise
- HTTP requests to the plugin's REST route containing SQL keywords such as UNION SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA
- Anomalous response times on REST endpoints associated with the HTML5 Video Player plugin, indicating time-based blind injection
- Unexpected outbound queries or data exfiltration originating from the WordPress database user
- Presence of new administrator accounts or modified wp_users and wp_usermeta entries following suspicious REST traffic
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule inspecting REST API traffic to /wp-json/ routes registered by the HTML5 Video Player plugin for SQL metacharacters
- Enable WordPress database query logging and alert on queries containing concatenated user input from REST handlers
- Review web server access logs for repeated requests to the plugin's REST endpoint from a single source IP
Monitoring Recommendations
- Correlate REST API request patterns with database error rates to identify probing activity
- Alert on HTTP 500 responses from plugin-registered REST routes, which often accompany failed injection attempts
- Monitor WordPress user table changes and authentication events for signs of credential extraction followed by account takeover
How to Mitigate CVE-2024-5522
Immediate Actions Required
- Update the HTML5 Video Player plugin to version 2.5.27 or later immediately
- Audit WordPress user accounts and rotate all administrator credentials if the plugin was exposed to the internet
- Review database access logs for signs of unauthorized SELECT, UPDATE, or INSERT activity through the plugin's REST endpoint
Patch Information
The vendor released version 2.5.27 of the HTML5 Video Player plugin, which introduces proper input sanitization and parameter binding on the affected REST route. Site administrators should apply the update through the WordPress plugin management interface or by downloading the fixed release from the WordPress plugin repository. Full technical details are documented in the WPScan Vulnerability Advisory.
Workarounds
- Deactivate and remove the HTML5 Video Player plugin until the patched version can be installed
- Restrict access to the plugin's REST route using WebServer-level access control lists or a WAF policy blocking unauthenticated requests
- Apply the principle of least privilege to the WordPress database user, limiting permissions to only the tables and operations required by the site
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
