8.2high
CVE-2016-20071
WordPress 404 Redirection Manager Plugin 1.0 SQL Injection
Published 4 mo ago · modified 3 mo ago · JSON
CVSS
8.2
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 23%
Public exploits
0
none known
Summary
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction (EPSS)
0.30% probability of exploitation in the next 30 days, higher than 23% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected products
- 404-redirection-manager 404 Redirection Manager
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- exploit-db.com /exploits/40941 · exploit
- wordpress.org /plugins/404-redirection-manager/ · product
- vulncheck.com /advisories/wordpress-404-redirection-manager-plugin-sql-injection · third-party-advisory
Sources
- CVE List: CVE-2016-20071
- NVD: CVE-2016-20071
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.