CVE-2024-6338: FV Flowplayer Video Player SQL Injection

CVE-2024-6338 Overview

CVE-2024-6338 is a time-based SQL injection vulnerability [CWE-89] in the FV Flowplayer Video Player plugin for WordPress. All versions up to and including 7.5.46.7212 are affected. The flaw resides in the exclude parameter, which lacks sufficient escaping and is passed into an unprepared SQL query. Authenticated users with Subscriber-level access or higher can append arbitrary SQL statements to extract sensitive data from the underlying database.

Critical Impact
Authenticated Subscriber-level attackers can exfiltrate arbitrary database content, including credentials and session tokens, from WordPress sites running vulnerable versions of FV Flowplayer.

Affected Products

Foliovision FV Flowplayer Video Player plugin for WordPress, versions <= 7.5.46.7212
WordPress installations exposing the plugin's video encoder admin functionality
Sites permitting user registration at Subscriber role or higher

Discovery Timeline

2024-07-19 - CVE-2024-6338 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6338

Vulnerability Analysis

The vulnerability is a time-based blind SQL injection in the FV Flowplayer Video Player plugin. The affected code path lives in models/video-encoder/class.fv-player-encoder-list-table.php around line 308, where the plugin builds a SQL query using the user-supplied exclude parameter. Because the parameter is neither escaped nor bound through a prepared statement, an attacker can concatenate additional SQL clauses onto the existing query.

Attackers use time-based payloads such as SLEEP() functions to infer database contents one bit at a time. Successful exploitation exposes WordPress user credentials, session tokens stored in wp_usermeta, API keys, and any other data accessible to the database user configured in wp-config.php.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin concatenates the untrusted exclude input directly into a query string instead of using $wpdb->prepare() with placeholders. WordPress provides esc_sql() and prepare() specifically to prevent this class of flaw, but neither is applied to the vulnerable parameter.

Attack Vector

Exploitation requires authenticated access at the Subscriber role or higher, a low bar on sites that allow open registration. The attacker sends a crafted request to the plugin's video encoder admin endpoint with a malicious exclude parameter containing conditional SLEEP() statements. Response latency reveals whether the injected boolean condition evaluated true, allowing byte-by-byte extraction of database records.

Refer to the Wordfence Vulnerability Report and the vulnerable source line for the affected implementation.

Detection Methods for CVE-2024-6338

Indicators of Compromise

HTTP requests to admin-ajax.php or plugin endpoints containing the exclude parameter with SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT.
Anomalously long response times from WordPress admin endpoints correlated with authenticated Subscriber sessions.
New or recently created low-privilege WordPress accounts making repeated requests to FV Flowplayer video encoder pages.

Detection Strategies

Inspect web server and WAF logs for URL-encoded SQL syntax within the exclude query parameter targeting FV Flowplayer routes.
Monitor MySQL slow query logs for queries containing SLEEP( or unusually long execution times originating from the WordPress database user.
Correlate authentication events for Subscriber-role accounts with subsequent access to plugin admin endpoints they should not normally require.

Monitoring Recommendations

Enable verbose logging on WordPress via a security plugin to capture parameter values on admin-ajax requests.
Alert on repeated 200 responses with response times exceeding a baseline threshold on FV Flowplayer endpoints.
Audit the wp_users table for newly registered accounts and review their subsequent request history.

How to Mitigate CVE-2024-6338

Immediate Actions Required

Update the FV Flowplayer Video Player plugin to a version later than 7.5.46.7212 immediately.
Disable open user registration or restrict the default new-user role until the plugin is patched.
Rotate WordPress user passwords, secret keys in wp-config.php, and any API credentials that may have been exposed via the database.

Patch Information

Foliovision addressed the vulnerability in a subsequent release published to the WordPress plugin repository. The fix is tracked in WordPress changeset 3121532, which adds proper query preparation for the exclude parameter. Administrators should apply the update through the WordPress admin dashboard or via wp-cli using wp plugin update fv-wordpress-flowplayer.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests where the exclude parameter contains SQL metacharacters or keywords.
Temporarily deactivate the FV Flowplayer plugin on sites that cannot be patched immediately.
Restrict access to /wp-admin/ paths by IP allowlist so unauthenticated and low-privilege users cannot reach the vulnerable endpoint.

bash

# Update the vulnerable plugin via wp-cli
wp plugin update fv-wordpress-flowplayer

# Verify the installed version is above 7.5.46.7212
wp plugin get fv-wordpress-flowplayer --field=version

# Optional: disable new user registration until patched
wp option update users_can_register 0