CVE-2025-31926: Sticky Radio Player SQL Injection Flaw

CVE-2025-31926 Overview

CVE-2025-31926 is a SQL Injection vulnerability in the LambertGroup Sticky Radio Player WordPress plugin (lbg-audio5-html5-shoutcast_sticky). The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. All versions of Sticky Radio Player up to and including 3.4 are affected.

Authenticated attackers with low privileges can inject crafted SQL statements through plugin parameters. Successful exploitation enables disclosure of sensitive database contents and limited impact on availability. The vulnerability carries a scope change, meaning compromise extends beyond the vulnerable component to other resources in the WordPress environment.

Critical Impact
Authenticated attackers can extract sensitive database records, including user credentials, session tokens, and configuration data, from the WordPress database.

Affected Products

LambertGroup Sticky Radio Player plugin (lbg-audio5-html5-shoutcast_sticky)
All versions from initial release through 3.4
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-05-16 - CVE-2025-31926 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31926

Vulnerability Analysis

The vulnerability resides in the Sticky Radio Player plugin's handling of user-supplied input that is concatenated into SQL queries. The plugin fails to sanitize or parameterize values before passing them to the WordPress database layer. Attackers with low-privilege authenticated access can submit crafted input that alters query semantics.

The attack vector is remote over the network with low complexity. The scope change indicator signals that exploitation affects resources beyond the plugin itself, including the broader WordPress database. Confidentiality impact is high, while integrity is unaffected and availability impact is low.

The EPSS probability for CVE-2025-31926 is 0.179%, reflecting limited observed exploitation attempts at this time.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The plugin constructs SQL statements by directly interpolating request parameters into query strings rather than using prepared statements or the $wpdb->prepare() API provided by WordPress. Special characters such as single quotes, comments, and UNION keywords pass through unchanged.

Attack Vector

An authenticated attacker sends an HTTP request to a plugin endpoint that processes user-controlled parameters. The attacker embeds SQL metacharacters and payloads inside one of the parameters that the plugin uses in a database query. The crafted payload modifies the query to return arbitrary rows, perform UNION-based extraction, or trigger time-based blind SQL inference.

The vulnerability manifests through plugin request handlers that reach the database without proper sanitization. See the Patchstack SQL Injection Vulnerability advisory for additional technical details.

Detection Methods for CVE-2025-31926

Indicators of Compromise

HTTP requests to Sticky Radio Player plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Unusual database query patterns in WordPress debug.log or MySQL slow query logs originating from the plugin
Outbound data exfiltration following authenticated requests to plugin AJAX or admin handlers
Unexpected creation or modification of WordPress user accounts after plugin interaction

Detection Strategies

Inspect web server access logs for requests to lbg-audio5-html5-shoutcast_sticky paths containing encoded SQL syntax
Deploy a web application firewall rule set that flags SQL injection payloads targeting WordPress plugin parameters
Enable MySQL general query logging to identify malformed or anomalous queries originating from the plugin
Correlate authenticated low-privilege user sessions with database error responses

Monitoring Recommendations

Monitor WordPress audit logs for failed and successful logins by Subscriber or Contributor accounts followed by plugin access
Alert on HTTP 500 responses from plugin endpoints, which often indicate failed injection attempts
Track database query volume and response size for the Sticky Radio Player plugin endpoints

How to Mitigate CVE-2025-31926

Immediate Actions Required

Disable or uninstall the Sticky Radio Player plugin until a patched version is confirmed and installed
Restrict plugin endpoint access through web server rules or a web application firewall
Audit WordPress user accounts and rotate credentials for any account with access to plugin functionality
Review the WordPress database for unauthorized modifications, particularly in the wp_users and wp_options tables

Patch Information

As of the last NVD update on 2026-04-23, no fixed version beyond 3.4 is referenced in the available data. Consult the Patchstack advisory for the latest vendor remediation status.

Workarounds

Remove the plugin from WordPress installations where it is not strictly required
Apply virtual patching through a web application firewall to block SQL injection payloads targeting plugin parameters
Limit authenticated user registration and restrict role assignments to trusted accounts only
Enforce least-privilege database users for the WordPress connection to reduce the blast radius of injection

bash

# Example WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate lbg-audio5-html5-shoutcast_sticky
wp plugin delete lbg-audio5-html5-shoutcast_sticky