CVE-2025-22536: 
WordPress vulnerability analysis and mitigation

The WP Music Player plugin for WordPress contains an SQL Injection vulnerability (CVE-2025-22536) that affects versions up to and including 1.3. The vulnerability was discovered by João Pedro Soares de Alcântara and disclosed on January 7, 2025. This security issue exists due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on existing SQL queries (WPScan, Patchstack).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 score of 7.6 (High). It affects authenticated users with administrator-level access and above, allowing them to append additional SQL queries to existing queries. This makes it possible for attackers to extract sensitive information from the database (WPScan).

When successfully exploited, the vulnerability allows authenticated attackers with administrator-level access to extract sensitive information from the database through SQL injection techniques (WPScan).

Currently, there is no known fix available for this vulnerability. Users of WP Music Player plugin version 1.3 and below should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (Patchstack).