CVE-2025-31637: SHOUT lbg-audio8-html5-radio_ads SQLi

CVE-2025-31637 Overview

CVE-2025-31637 is a SQL injection vulnerability affecting the LambertGroup SHOUT plugin (lbg-audio8-html5-radio_ads) for WordPress. The flaw allows authenticated attackers with low privileges to inject malicious SQL statements through unsanitized input passed to database queries. The vulnerability impacts all versions of SHOUT up to and including 3.5.3. Exploitation requires network access and low-level authentication, but no user interaction. The issue is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated attackers can read sensitive database contents, including WordPress user credentials and configuration data, by injecting crafted SQL payloads into vulnerable plugin parameters.

Affected Products

• LambertGroup SHOUT (lbg-audio8-html5-radio_ads) WordPress plugin
• All versions from n/a through 3.5.3
• WordPress installations using the SHOUT HTML5 radio player with ads

Discovery Timeline

• 2025-05-16 - CVE-2025-31637 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31637

Vulnerability Analysis

The SHOUT plugin fails to properly neutralize special characters in user-supplied input before incorporating it into SQL queries. An authenticated attacker with low privileges can craft requests that alter the structure of backend database queries. Successful exploitation gives the attacker read access to arbitrary database tables and limited impact on availability. The scope is changed, meaning the vulnerable component affects resources beyond its own security boundary, which in WordPress translates to access across the entire site database.

The EPSS probability is approximately 0.35%, placing this issue in the 26th percentile for likelihood of near-term exploitation.

Root Cause

The root cause is missing or insufficient input sanitization on parameters consumed by SQL queries within the plugin. WordPress provides safe query primitives such as $wpdb->prepare() and parameterized statements, but the affected plugin code paths concatenate user input directly into queries. This pattern is the canonical manifestation of [CWE-89].

Attack Vector

The attack is delivered over the network through standard HTTP(S) requests to the WordPress site. The attacker must hold an authenticated session at any low-privilege role that can reach the vulnerable plugin endpoint. The attacker submits crafted parameter values containing SQL metacharacters and Boolean or UNION-based payloads. The injected SQL executes within the WordPress database context, allowing data extraction from wp_users, wp_usermeta, and other tables.

The vulnerability is described in prose only; no public proof-of-concept code has been released. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-31637

Indicators of Compromise

• HTTP requests to SHOUT plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA
• Unexpected database errors in WordPress debug logs originating from the plugin code path
• Spikes in response time on plugin endpoints indicating time-based blind SQL injection probes
• New or unexpected administrator accounts created shortly after suspicious plugin requests

Detection Strategies

• Inspect WordPress access logs for requests targeting lbg-audio8-html5-radio_ads parameters with encoded SQL syntax
• Enable MySQL general query logging temporarily and correlate anomalous query patterns to plugin-handled HTTP requests
• Deploy a Web Application Firewall ruleset that flags SQL injection signatures against requests to the plugin path

Monitoring Recommendations

• Monitor authentication events and privilege changes on WordPress installations running the SHOUT plugin
• Alert on outbound database dumps or unusually large query result sets associated with plugin endpoints
• Track failed and successful logins for low-privilege roles followed by access to plugin AJAX or REST endpoints

How to Mitigate CVE-2025-31637

Immediate Actions Required

• Identify all WordPress sites running the LambertGroup SHOUT plugin at version 3.5.3 or earlier
• Deactivate and remove the plugin until a vendor-supplied patch is verified installed
• Rotate WordPress administrator and database credentials if exploitation is suspected
• Review user tables for unauthorized account creation or role modification

Patch Information

No fixed version is referenced in the NVD record at the time of publication. Monitor the Patchstack advisory and the LambertGroup vendor channel for an updated release beyond 3.5.3. Apply the vendor patch immediately upon release and verify the plugin version after update.

Workarounds

• Restrict access to the WordPress admin area and plugin endpoints using IP allowlisting at the web server or reverse proxy
• Enforce strong authentication and least-privilege role assignments to reduce the pool of accounts that meet the low-privilege precondition
• Deploy WAF rules that block SQL injection patterns on requests targeting the SHOUT plugin paths
• Disable the plugin entirely on sites where the HTML5 radio functionality is non-essential

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate lbg-audio8-html5-radio_ads
wp plugin delete lbg-audio8-html5-radio_ads