WordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerability

The SQL Injection vulnerability in tPlayer poses a significant risk to WordPress websites utilizing the plugin. An attacker could exploit this flaw to bypass authentication mechanisms, retrieve sensitive user data (usernames, passwords, email addresses), modify database records, or even execute arbitrary commands on the server. Successful exploitation could lead to complete website compromise and data exfiltration. The impact is particularly severe given the potential for widespread deployment of the plugin across numerous WordPress sites, increasing the attack surface.

WordPress websites using the tPlayer plugin are at risk, particularly those with default configurations or limited security hardening. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially impact others.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/tplayer/

• generic web:

curl -I https://example.com/wp-content/plugins/tplayer/ | grep SQL

1. 2025-12-18Disclosure

   disclosure

1. आरक्षित2025-09-25
2. प्रकाशित2025-12-18
3. संशोधित2026-04-28
4. EPSS अद्यतन2026-03-23

Due to the lack of a released patch, immediate mitigation strategies are crucial. First, consider temporarily disabling the tPlayer plugin to prevent potential exploitation. Implement a Web Application Firewall (WAF) with rules designed to detect and block SQL Injection attempts targeting the plugin's endpoints. Carefully review and sanitize any user input processed by the plugin. Monitor WordPress database logs for suspicious SQL queries. Regularly back up your WordPress database to facilitate restoration in case of a successful attack. Once a patch is released, upgrade to the fixed version immediately and verify the fix by attempting a SQL Injection payload on the affected endpoints.