CVE-2026-84937: YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Contributor role or any higher-privileged role can exploit it. Sites that allow untrusted users to register or receive Contributor access are therefore more exposed.
What access does an attacker need?
The attacker needs a WordPress account with at least the Contributor role and must be able to submit input through the plugin's ytp_ajax functionality. The available information does not indicate that unauthenticated visitors can exploit it.
What can an attacker obtain through exploitation?
The issue allows SQL injection that can be used to read arbitrary data from the WordPress database. The provided information does not establish whether database modification or server-side code execution is possible.
Which plugin versions are affected?
Versions of the Video Player for YouTube WordPress plugin before 2.1.0 are affected. Updating to version 2.1.0 or later addresses the affected version range described here.
What can be done if an update cannot be applied immediately?
Restrict Contributor and higher-level accounts to trusted users, and review existing accounts for unnecessary Contributor access. This reduces the number of users able to reach the vulnerable functionality.