bPlugins - SQLi (CVE-2024-1061)

CVE-2024-1061 is a vulnerability in the 'HTML5 Video Player' WordPress plugin that exposes sites to unauthenticated SQL injection through improper handling of an input parameter in the plugin’s backend.

CrowdSec has been tracking this vulnerability and its exploits since 14th of May 2024.

CrowdSec network data shows that most actors exploiting CVE-2024-1061 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2024-1061 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2024-1061 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Detectable attack patterns are characterized by requests attempting to abuse the plugin's backend functionality, most likely targeting endpoints associated with video viewing features.