CVE-2016-20073: SQL Injection in Answer My Question 1.3 WordPress Plugin

Technical summary

CVE-2016-20073 is an unauthenticated SQL injection vulnerability in the Answer My Question 1.3 WordPress plugin. The vulnerability exists in the modal.php endpoint, which fails to properly sanitize the 'id' POST parameter before incorporating it into SQL queries. This classic SQL injection pattern (CWE-89) allows attackers to inject arbitrary SQL syntax, enabling data exfiltration from the WordPress database. The attack vector is network-based with low attack complexity, requiring no authentication or user interaction, resulting in high confidentiality impact with limited integrity risk.

Business impact

Organizations running Answer My Question 1.3 face exposure of sensitive WordPress database contents, including user metadata, configuration settings, and potentially customer or internal data stored within WordPress taxonomy structures. The exposure is particularly concerning for multi-tenant or SaaS WordPress installations where data leakage could affect multiple customers. While the vulnerability does not enable data modification or denial of service, the information disclosure alone can support reconnaissance for secondary attacks or compliance violations if regulated data is stored in the affected database.

Affected systems

WordPress installations with the Answer My Question plugin version 1.3 are affected. The vulnerability applies to any deployment using this specific plugin version, regardless of WordPress core version, hosting provider, or configuration. Sites with this plugin installed and accessible via standard WordPress paths are at risk.

Exploitability

This vulnerability is straightforward to exploit. An attacker requires only network access to the WordPress installation and the ability to craft HTTP POST requests to the plugin's modal.php endpoint. No authentication, special privileges, or user interaction is necessary. The low attack complexity means that standard web request tools or simple scripts are sufficient; exploitation does not depend on timing, race conditions, or user behavior. Public disclosure of the vulnerability and plugin's popularity make discovery of vulnerable instances trivial.

Remediation

The immediate remediation is to deactivate and remove the Answer My Question 1.3 plugin from all affected WordPress installations. Site operators should verify whether the plugin is still maintained by the vendor; if an updated version exists with SQL injection fixes, update to that version after testing in a staging environment. If the plugin is abandoned or no patch is available, removal is the only secure option. No server-side mitigations can reliably protect against SQL injection in the application layer without removing or patching the vulnerable code.

Patch guidance

Review the official Answer My Question plugin repository or the vendor's security advisories for an available patched version. If a security update exists, test it thoroughly in a non-production environment before deploying to live sites. Verify that any patch addresses the SQL injection in the 'id' POST parameter handling. If no patch is forthcoming from the vendor, plan for plugin removal and identify alternative solutions for the functionality Answer My Question provided. Update your inventory records to prevent re-installation of the vulnerable version.

Detection guidance

Monitor web server and WordPress audit logs for POST requests to */wp-content/plugins/answer-my-question/modal.php containing suspicious SQL syntax in the 'id' parameter (such as UNION, SELECT, OR 1=1, comments, or other SQL keywords). Deploy Web Application Firewall (WAF) rules to block requests containing common SQL injection patterns targeting this endpoint. WordPress security plugins with SQL injection detection can flag malicious requests. Query the wp_options and wp_plugins tables to confirm the presence and version of Answer My Question. Implement database query logging to detect unusual SQL patterns if the plugin remains in use during transition periods.

Why prioritize this

This vulnerability merits urgent remediation because it enables unauthenticated, remotely exploitable data exfiltration from WordPress databases with no user interaction required. The CVSS 8.2 HIGH score reflects the high confidentiality impact and network accessibility. Although not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, the simplicity of exploitation and the plugin's historical presence in WordPress ecosystems make it a likely target for automated scanning and opportunistic attacks. The vulnerability is especially critical for sites storing regulated, proprietary, or customer data in WordPress.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) is driven by four key factors: (1) Network-accessible attack vector with no authentication required (AV:N/PR:N), (2) Low attack complexity, indicating straightforward exploitation (AC:L), (3) High confidentiality impact through SQL injection-enabled data exfiltration (C:H), and (4) Modest integrity impact reflecting potential but limited update capabilities via SQL injection (I:L). The score does not credit availability impact (A:N) because the vulnerability does not enable denial-of-service attacks. This classification correctly positions the vulnerability as a serious but not critical threat, with the urgency driven primarily by the ease of exploitation and breadth of affected sites.

Frequently asked questions