This vulnerability in the WordPress Chameleon HTML5 Audio Player With/Without Playlist plugin allows attackers to inject arbitrary SQL into database queries. The flaw stems from the improper sanitization of input that becomes part of an SQL command, which is classified as CWE‑89. Successful exploitation can lead to unauthorized reading, modification, or deletion of database contents, potentially exposing sensitive user information, credentials, and site data.

The affected product is the WordPress plugin Chameleon HTML5 Audio Player With/Without Playlist from LambertGroup, versions up to and including 3.5.6. All WordPress sites that have installed the plugin at these versions are vulnerable until updated to a later, patched release.

The vulnerability carries a CVSS score of 8.5, indicating high severity, while the EPSS score is below 1%, suggesting a currently low exploitation probability. It is not listed in the CISA KEV catalog, meaning there is no known large‑scale exploitation. The attack vector is likely through plugin input fields exposed in the WordPress admin interface or public pages, although the CVE description does not detail specific prerequisites. Regardless, any attacker who can reach these input points has the potential to manipulate the database.