WordPress Audio Player Plugin <= 2.0 - Multiple SQL Injection

Because of these vulnerabilities, the administrators can execute arbitrary SQL commands via the “itemid” parameter in the wonderplugin_audio_show_item. Also, an authenticated user can execute arbitrary SQL commands via the “item[id]” parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php.

Solution

           Update the plugin.