CVE-2024-1061 is a High severity unauthenticated SQL injection, scored 8.6, in the HTML5 Video Player plugin for WordPress. Versions before 2.5.25 are affected, and Tenable's advisory says the issue seems to be fixed in 2.5.25. Update the plugin to 2.5.25 or later.
What's affected
Tenable's advisory TRA-2024-02 and the record agree: the HTML5 Video Player WordPress plugin before 2.5.25 is affected. Tenable words the fix carefully. It says the issue "seems to have been fixed" in 2.5.25 and notes that the vendor did not acknowledge the vulnerability.
Tenable scored it CVSS 8.6 base and 8.2 temporal, which matches the record's 8.6. The vector shows a network attack with no login needed and a changed scope, with high impact on confidentiality only.
How to check if you're exposed
In the WordPress admin, open Plugins, Installed Plugins and read the version shown under HTML5 Video Player. From a shell with WP-CLI, list plugins and their versions.
wp plugin list --fields=name,status,version,update
Compare the version with the affected range above. If the plugin is not installed, you are not exposed through this CVE. The free in-browser dependency scan also covers dependencies in your own code, though WordPress plugins are tracked by the site, not a lockfile.
What to do now
- List WordPress sites that use the HTML5 Video Player plugin and note the version.
- Update to 2.5.25 or later. Tenable lists no interim workaround.
- If you cannot update at once, deactivate the plugin until you can.
- Review database and web logs for unusual requests to the plugin's REST route, and rotate credentials stored in the database if you see signs of misuse.
- Ask your web application firewall vendor whether a rule covers this plugin.
Why it matters
The cause is a lack of validation of the id parameter used by the get_view function, which can be reached without logging in. The class is SQL injection, CWE-89: user input ends up inside a database query and changes what the query does. Tenable's scoring points at data disclosure.
A WordPress database holds user records, password hashes and site settings, so an unauthenticated read path is worth closing quickly. Tenable could not reach the vendor's security contact and told the WordPress security team on 16 January 2024. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-1061?
Tenable says the issue seems fixed in 2.5.25, so update to 2.5.25 or later.
Does an attacker need an account?
No. The record and Tenable describe it as unauthenticated.
Sources
Last reviewed: 19 October 2026.
