CVE-2025-32287: HTML5 Audio Player PRO SQL Injection

CVE-2025-32287 Overview

CVE-2025-32287 is a SQL Injection vulnerability affecting the LambertGroup Responsive HTML5 Audio Player PRO With Playlist plugin (lbg-audio2-html5) for WordPress. The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. Authenticated attackers with low privileges can inject SQL statements through the plugin to access backend database content. All versions up to and including 3.5.7 are affected. The issue was published to the National Vulnerability Database (NVD) on May 16, 2025.

Critical Impact
Attackers with low-privilege authenticated access can extract sensitive database contents, including user credentials and configuration data, by injecting crafted SQL payloads through vulnerable plugin parameters.

Affected Products

LambertGroup Responsive HTML5 Audio Player PRO With Playlist (lbg-audio2-html5)
All versions from initial release through 3.5.7
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-05-16 - CVE-2025-32287 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32287

Vulnerability Analysis

The vulnerability falls under [CWE-89], Improper Neutralization of Special Elements used in an SQL Command. The plugin accepts user-supplied input and concatenates it into SQL queries without proper sanitization or parameterization. An authenticated attacker can manipulate request parameters to alter the structure of database queries executed by the plugin.

Because the vulnerability has a scope change component, successful exploitation can affect resources beyond the plugin itself, including the underlying WordPress database tables used by other components. Attackers can read arbitrary database content, including the wp_users table containing password hashes and session tokens.

The EPSS score is 0.267% with a percentile of 18.246, indicating relatively low observed exploitation activity at this time. However, plugin-based SQL injection flaws in WordPress remain a common attack target.

Root Cause

The plugin constructs SQL queries by concatenating user-controlled input directly into query strings. It does not use prepared statements or apply WordPress-provided sanitization functions such as $wpdb->prepare() or esc_sql() before passing values to database operations.

Attack Vector

Exploitation requires network access and authenticated low-privilege credentials. No user interaction is needed. An attacker sends crafted HTTP requests containing SQL metacharacters to plugin endpoints that handle audio playlist data. The injected SQL executes within the WordPress database context, returning arbitrary data through application responses or error messages.

No verified public proof-of-concept code is available. Technical details of the injection point are documented in the Patchstack SQL Injection Vulnerability advisory.

Detection Methods for CVE-2025-32287

Indicators of Compromise

HTTP requests to lbg-audio2-html5 plugin endpoints containing SQL syntax such as UNION SELECT, OR 1=1, SLEEP(, or encoded variants
Unexpected database errors in WordPress logs originating from plugin queries
Outbound queries against wp_users, wp_options, or wp_usermeta tables from plugin code paths
Unusual authenticated session activity from subscriber or contributor accounts accessing plugin functionality

Detection Strategies

Inspect web server access logs for parameter values containing SQL keywords, quote characters, or comment sequences (--, #, /*) targeting plugin URIs
Enable WordPress SAVEQUERIES or database query logging to identify malformed queries originating from lbg-audio2-html5
Deploy Web Application Firewall (WAF) rules that match SQL injection signatures on requests to the affected plugin path

Monitoring Recommendations

Monitor authentication events for low-privilege accounts accessing plugin administrative endpoints
Alert on database errors referencing the plugin's table prefix or query patterns
Track outbound data volume from the web server to detect bulk data exfiltration through query results

How to Mitigate CVE-2025-32287

Immediate Actions Required

Identify all WordPress installations running lbg-audio2-html5 version 3.5.7 or earlier
Deactivate the plugin until a vendor-supplied patch is verified and installed
Rotate WordPress administrator credentials and database passwords if compromise is suspected
Audit user accounts created or modified during the exposure window

Patch Information

At the time of NVD publication, the advisory lists affected versions through <= 3.5.7. Review the Patchstack SQL Injection Vulnerability advisory for the latest patched release information from LambertGroup.

Workarounds

Restrict access to plugin endpoints using WAF rules or .htaccess IP allowlisting
Remove low-privilege accounts that are not strictly required, reducing the authenticated attack surface
Apply virtual patching through a WAF to block SQL injection patterns targeting the plugin path
Enforce least-privilege database credentials for the WordPress database user to limit query capabilities

bash

# Example: Apache configuration to restrict access to the plugin path
<Location "/wp-content/plugins/lbg-audio2-html5/">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>