CVE-2025-32306: Radio Player WordPress Plugin SQLi Flaw

CVE-2025-32306 Overview

CVE-2025-32306 is a blind SQL injection vulnerability in the LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin (audio4-html5). The flaw affects all plugin versions up to and including 4.4.6. Authenticated attackers with low privileges can inject malicious SQL statements through unsanitized input handled by the plugin. The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Successful exploitation enables data extraction from the WordPress database and can affect components beyond the vulnerable plugin scope.

Critical Impact

A low-privileged authenticated attacker can execute blind SQL injection attacks against the WordPress database, exposing sensitive data including user credentials, session tokens, and configuration values.

Affected Products

• LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin (audio4-html5)
• All versions from initial release through 4.4.6
• WordPress installations with the plugin enabled

Discovery Timeline

• 2025-05-16 - CVE-2025-32306 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32306

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements in SQL commands within the audio4-html5 plugin. User-supplied input flows into database queries without parameterization or adequate sanitization. Attackers craft requests containing SQL syntax that the plugin concatenates directly into queries executed by the WordPress database layer.

Because the injection is blind, attackers do not receive direct query output. Instead, they infer database contents through boolean-based or time-based inference techniques. The scope change indicated by the vulnerability metrics means exploitation can affect resources beyond the vulnerable plugin, including other WordPress tables and site components.

The EPSS score is 0.179% at the 39th percentile, indicating limited observed exploitation activity at this time. No public proof-of-concept exploit has been published.

Root Cause

The root cause is the absence of prepared statements or input sanitization in database query construction. The plugin concatenates request parameters directly into SQL strings, allowing attackers to break out of the intended query context. WordPress provides the $wpdb->prepare() method specifically to prevent this class of flaw, but the affected code paths do not use it.

Attack Vector

The attack vector is network-based and requires low-privileged authentication. An attacker with a valid WordPress account at subscriber level or higher submits a crafted HTTP request to a vulnerable plugin endpoint. The request includes SQL payloads in parameters processed by the plugin. The plugin executes the modified query against the database, returning results through inference channels such as response timing or conditional content differences.

The vulnerability mechanism follows a standard blind SQL injection pattern. Refer to the Patchstack advisory for additional technical details.

Detection Methods for CVE-2025-32306

Indicators of Compromise

• HTTP requests to audio4-html5 plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK
• Anomalous response times on plugin requests indicating time-based blind SQL injection probing
• Database error log entries referencing malformed queries originating from the plugin
• Unusual outbound queries from the WordPress application user against tables outside the plugin scope

Detection Strategies

• Inspect WordPress access logs for repeated requests to plugin endpoints from a single authenticated session
• Deploy a Web Application Firewall (WAF) with SQL injection signatures tuned for WordPress plugin parameters
• Enable MySQL general query logging temporarily to identify anomalous query patterns from the WordPress user
• Correlate authentication events with subsequent plugin requests to identify credential abuse

Monitoring Recommendations

• Monitor WordPress audit logs for low-privileged accounts accessing plugin admin actions
• Alert on database queries containing inference patterns such as IF(SUBSTRING(...)) or SLEEP(
• Track HTTP 500 responses originating from plugin URLs as indicators of injection probing
• Review user account creation events for unauthorized subscriber-level accounts

How to Mitigate CVE-2025-32306

Immediate Actions Required

• Deactivate the Radio Player Shoutcast & Icecast WordPress Plugin until a patched version is installed
• Restrict user registration and audit existing low-privileged accounts for legitimacy
• Apply WAF rules blocking SQL injection patterns targeting the audio4-html5 plugin path
• Rotate WordPress administrator credentials and database passwords if compromise is suspected

Patch Information

At the time of publication, the vulnerability affects all versions through 4.4.6. Consult the Patchstack advisory for the latest patch availability from LambertGroup.

Workarounds

• Remove or disable the plugin in environments where it is not actively used
• Restrict access to plugin endpoints via web server access controls or IP allowlisting
• Enforce the principle of least privilege by limiting account creation and subscriber-level access
• Deploy virtual patching through a WAF to block injection payloads until an official fix is available

# Example WAF rule pattern to block SQL injection against plugin path
# ModSecurity rule example
SecRule REQUEST_URI "@contains /wp-content/plugins/audio4-html5/" \
    "id:1003200,phase:2,deny,status:403,\
    chain,msg:'Block SQLi attempt on audio4-html5 plugin'"
    SecRule ARGS "@rx (?i)(union[\s\+]+select|sleep\s*\(|benchmark\s*\(|or\s+1\s*=\s*1)"