Executive brief
A popular WordPress plugin for embedding YouTube videos contains a SQL injection vulnerability that allows any user with Contributor access (the ability to edit posts) to extract sensitive data from the WordPress database, including usernames and password hashes. An attacker with a Contributor account can read arbitrary database records without requiring special privileges or user interaction.
Technical details
The Video Player for YouTube WordPress plugin fails to properly sanitize and escape user-supplied input in the ytp_ajax AJAX action handler before using it in SQL statements. The vulnerability exists in the Presets model's createOrUpdate method, where request parameter names (which WordPress does not escape) are passed directly into SQL queries. An attacker with Contributor role or higher can inject arbitrary SQL by crafting malicious parameter names containing SQL syntax, allowing them to append UNION SELECT statements or other SQL constructs to exfiltrate data from any database table readable by the WordPress database user. The vulnerability requires authentication as a Contributor-level user and is fixed in version 2.1.0.
Affected products
- yt-player Video Player for YouTube < 2.1.0
Timeline
- 2026-09-03: disclosed
- 2026-09-05: advisory