CVE-2016-20071: Critical SQL Injection in WordPress 404 Redirection Manager Plugin v1.0

Technical summary

CVE-2016-20071 is an unauthenticated SQL injection vulnerability (CWE-89) in the 404 Redirection Manager WordPress plugin version 1.0. The vulnerability exists because user-supplied input passed through GET parameters is not properly sanitized before being incorporated into SQL queries. An attacker can inject arbitrary SQL commands to bypass query logic, extract data from the WordPress database, or modify query results. The CVSS 3.1 score of 8.2 (HIGH) reflects the network-accessible nature, low attack complexity, and high confidentiality impact, though data modification is limited and availability is not directly threatened.

Business impact

Compromise of a WordPress site running this vulnerable plugin puts customer data, user credentials, and sensitive business information at immediate risk. An attacker could extract user records, email addresses, passwords, or any other information stored in the database. For e-commerce sites, this could include payment information or order history. Reputational damage, regulatory fines under GDPR or similar laws, and loss of customer trust are significant secondary impacts. The ease of exploitation—requiring only a crafted URL—means this risk is active and ongoing without immediate detection.

Affected systems

WordPress installations with the 404 Redirection Manager plugin version 1.0 are affected. The vulnerability is version-specific; verify whether your site uses this exact version. No evidence of exploitation in the wild has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, though public exploit awareness may still exist. Sites running version 1.0 should treat this as urgent. Check your WordPress plugin directory for this plugin and confirm the installed version.

Exploitability

This vulnerability is highly exploitable. Attack complexity is low—no special conditions or timing are required. An attacker needs only to craft a malicious GET request with SQL injection payloads and send it to any page where the plugin processes 404 redirects. No authentication is needed. The public nature of this CVE means weaponized payloads are or will become readily available. Active threat actors commonly target WordPress plugins due to the large installed base and frequency of unpatched instances.

Remediation

Immediately deactivate and remove the 404 Redirection Manager plugin version 1.0 from all affected WordPress installations. No patch version has been identified for this plugin in available vendor advisories; consider whether an alternative 404 redirection solution is necessary for your site's functionality. If a patched version becomes available from the plugin developer, verify the version number against the official WordPress plugin repository before installing. As an interim measure, block access to the plugin's functionality via Web Application Firewall rules if removal is not immediately feasible.

Patch guidance

As of the current data, no patched version of the 404 Redirection Manager plugin has been released or documented. Contact the plugin developer directly to determine if a fix is available. Check the official WordPress.org plugin page for this plugin to see if an update is posted. If no patch is forthcoming from the developer, plan to migrate to an alternative WordPress redirection plugin that actively maintains security. Verify any replacement solution against current security reviews before deployment.

Detection guidance

Monitor web server logs and WAF logs for GET requests containing SQL injection keywords and patterns (e.g., UNION, SELECT, --, ;, OR 1=1) directed at paths associated with the 404 Redirection Manager plugin. Use WordPress security plugins or database activity monitoring to detect unusual SQL queries or unauthorized database access. Check the WordPress admin panel for the plugin's presence and version number under Plugins → Installed Plugins. Review database access logs for queries originating from web requests rather than legitimate application code, particularly those containing comment syntax or logical operators.

Why prioritize this

This vulnerability should be a top priority for immediate remediation. The combination of unauthenticated access, network reachability, ease of exploitation, and direct access to sensitive data makes it an active and high-impact threat. The HIGH CVSS score and CWE-89 (SQL Injection) classification reflect well-understood attack techniques. Organizations running outdated plugins are frequently targeted in opportunistic scans. Delay increases the window of exposure.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) is driven by network accessibility (AV:N), low attack complexity (AC:L), lack of authentication requirement (PR:N), and high confidentiality impact (C:H). The score is not critical (9.0+) because the vulnerability does not allow arbitrary code execution or denial of service; integrity and availability impacts are limited (I:L, A:N). However, the confidentiality breach alone—unrestricted database read access—justifies the HIGH rating and urgent response posture.

Frequently asked questions