CVE-2025-32290: Sticky HTML5 Music Player SQLi Flaw

CVE-2025-32290 Overview

CVE-2025-32290 is a SQL Injection vulnerability in the LambertGroup Sticky HTML5 Music Player WordPress plugin (lbg-audio3-html5). The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. Authenticated attackers with low privileges can inject crafted SQL statements through vulnerable plugin parameters. All versions of Sticky HTML5 Music Player up to and including 3.1.6 are affected. The vulnerability has a scope change, meaning successful exploitation can impact resources beyond the vulnerable component itself. The issue exposes confidential database contents and can degrade availability of the WordPress site.

Critical Impact
An authenticated attacker can extract sensitive database records, including user credentials and configuration data, from any WordPress site running Sticky HTML5 Music Player 3.1.6 or earlier.

Affected Products

LambertGroup Sticky HTML5 Music Player (lbg-audio3-html5) — all versions through 3.1.6
WordPress installations with the vulnerable plugin activated
Any backend database (typically MySQL/MariaDB) accessible to the affected plugin

Discovery Timeline

2025-05-16 - CVE-2025-32290 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32290

Vulnerability Analysis

The vulnerability resides in the Sticky HTML5 Music Player plugin's handling of user-supplied input passed into database queries. The plugin fails to apply parameterized queries or proper sanitization functions such as wpdb::prepare() before concatenating input into SQL statements. An authenticated user with low privileges can craft a request containing SQL metacharacters that alters the original query logic. The attack is delivered over the network without user interaction. Because the CVSS scope is marked as changed, the impact extends beyond the plugin's own data boundary to the underlying WordPress database. Successful exploitation yields high confidentiality impact and limited availability impact, while integrity remains unaffected.

Root Cause

The root cause is the absence of input neutralization on parameters consumed by the plugin's database access layer. Developers concatenated request parameters directly into SQL strings instead of using prepared statements with placeholders. This pattern allows attacker-controlled values to break out of the intended string context and inject additional SQL clauses such as UNION SELECT or boolean-based payloads.

Attack Vector

Exploitation requires the attacker to hold authenticated WordPress access at a low privilege tier, such as Subscriber or Contributor. The attacker submits an HTTP request to a plugin endpoint containing malicious SQL payloads in vulnerable parameters. The injected SQL executes within the WordPress database context, returning data through error messages, blind boolean conditions, or time-based responses.

No verified public proof-of-concept code is available for CVE-2025-32290. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32290

Indicators of Compromise

Unexpected database queries containing UNION, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA references originating from authenticated plugin endpoints.
Web server access logs showing requests to lbg-audio3-html5 plugin paths with URL-encoded SQL metacharacters such as %27, %23, or --.
Anomalous outbound data transfers immediately following low-privileged user authentication events.

Detection Strategies

Monitor WordPress audit logs for low-privilege users issuing requests to admin-ajax endpoints associated with lbg-audio3-html5.
Deploy a web application firewall (WAF) with signatures tuned for SQL injection patterns targeting WordPress plugins.
Enable MySQL/MariaDB general query logging in non-production environments to identify malformed or suspicious query structures.

Monitoring Recommendations

Alert on repeated HTTP 500 responses from plugin endpoints, which often indicate injection probing.
Correlate authentication events for Subscriber-level accounts with database query volume spikes.
Track creation of new administrative users or unexpected modifications to the wp_users and wp_options tables.

How to Mitigate CVE-2025-32290

Immediate Actions Required

Deactivate the Sticky HTML5 Music Player plugin until a patched release is confirmed available from LambertGroup.
Audit all WordPress user accounts and remove or disable unused low-privilege accounts that could be leveraged for exploitation.
Rotate database credentials and WordPress secret keys if exploitation is suspected.

Patch Information

No fixed version is identified in the published advisory. Affected operators should monitor the Patchstack advisory and the LambertGroup vendor channels for an updated release beyond version 3.1.6.

Workarounds

Restrict access to the WordPress site using IP allowlisting or HTTP authentication at the web server layer.
Apply WAF rules that block SQL metacharacters in parameters submitted to lbg-audio3-html5 plugin endpoints.
Enforce least privilege on the WordPress database user, removing FILE, CREATE, and DROP privileges where not required.

bash

# Example: revoke unnecessary MySQL privileges from the WordPress DB user
REVOKE FILE, CREATE, DROP, ALTER ON *.* FROM 'wordpress_user'@'localhost';
FLUSH PRIVILEGES;