CVE-2026-84937: Video Player for YouTube SQL Injection

CVE-2026-84937 Overview

CVE-2026-84937 affects the Video Player for YouTube WordPress plugin in versions prior to 2.1.0. The plugin fails to sanitize and escape user-supplied input before passing it to a SQL statement. Authenticated users with the Contributor role or higher can inject SQL and read arbitrary data from the underlying database. The flaw maps to [CWE-89], SQL Injection, and carries a network attack vector with high privileges required.

Critical Impact
Authenticated contributors and above can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session tokens, and other stored content.

Affected Products

Video Player for YouTube WordPress plugin versions prior to 2.1.0
WordPress sites with Contributor-level (or higher) user registration enabled
Any site running the vulnerable plugin regardless of underlying database engine

Discovery Timeline

2026-09-05 - CVE-2026-84937 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84937

Vulnerability Analysis

The vulnerability resides in a request handler exposed by the Video Player for YouTube plugin. User-supplied parameters flow directly into a SQL query without prepared statements or escaping through WordPress $wpdb->prepare(). An authenticated attacker with the Contributor role can craft malicious input to alter the query structure and extract data from any table the WordPress database user can read.

Because the scope is changed (S:C), the attacker can reach data outside the plugin's own schema. This includes the wp_users table containing password hashes, session tokens stored in wp_usermeta, and any custom tables added by other plugins. Confidentiality impact is high, while integrity and availability remain unaffected in the base scoring.

Root Cause

The root cause is missing input sanitization on parameters used in a dynamic SQL statement. The plugin concatenates untrusted input into the query string rather than binding parameters. WordPress provides $wpdb->prepare() for parameterized queries, but the vulnerable code path bypasses this safeguard.

Attack Vector

Exploitation requires an authenticated session with at least the Contributor role. The attacker submits a crafted request to the vulnerable plugin endpoint containing SQL metacharacters in the affected parameter. Common techniques include UNION SELECT injection to exfiltrate rows from arbitrary tables or time-based blind injection when responses do not echo results. See the WPScan Vulnerability Report for the specific parameter and endpoint details.

Detection Methods for CVE-2026-84937

Indicators of Compromise

Requests to Video Player for YouTube plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or INFORMATION_SCHEMA
Web server logs showing unusually long query strings or encoded payloads (%27, %20UNION%20) from authenticated Contributor accounts
Database error messages returned in HTTP responses referencing SQL syntax faults
Unexpected read activity against wp_users, wp_usermeta, or wp_options tables in database audit logs

Detection Strategies

Enable WordPress database query logging and alert on queries originating from the plugin that contain concatenated user input
Deploy a Web Application Firewall (WAF) with SQL injection signatures tuned for WordPress plugin parameters
Review authentication logs for Contributor accounts exhibiting sudden increases in plugin-endpoint requests
Correlate elevated 500-status responses from /wp-admin/admin-ajax.php with authenticated low-privilege sessions

Monitoring Recommendations

Monitor for new Contributor account creation followed by rapid plugin interaction
Track outbound data flows from the WordPress host that could indicate database exfiltration
Alert on modifications to the wp_users table performed outside the WordPress admin UI
Review plugin version inventory across managed WordPress instances to identify installations below 2.1.0

How to Mitigate CVE-2026-84937

Immediate Actions Required

Upgrade the Video Player for YouTube plugin to version 2.1.0 or later on all WordPress instances
Audit existing Contributor, Author, Editor, and Administrator accounts and disable any that are unrecognized
Rotate WordPress user passwords and secret keys defined in wp-config.php if compromise is suspected
Review database access logs for evidence of unauthorized SELECT queries against sensitive tables

Patch Information

The plugin vendor addressed the issue in version 2.1.0 by applying proper input sanitization and parameterized queries. Refer to the WPScan Vulnerability Report for confirmation of the fixed version. Site administrators should update through the WordPress plugin dashboard or via wp-cli plugin update.

Workarounds

Deactivate and remove the Video Player for YouTube plugin until the patched version can be deployed
Restrict Contributor role assignment and disable open user registration in Settings > General
Deploy WAF rules to block SQL injection payloads targeting the plugin's request parameters
Apply least-privilege database credentials so the WordPress database user cannot read tables outside the site schema

bash

# Update the vulnerable plugin using WP-CLI
wp plugin update video-player-for-youtube --version=2.1.0

# Verify the installed version
wp plugin get video-player-for-youtube --field=version

# Disable open registration as a hardening step
wp option update users_can_register 0