CVE-2016-20073

Vulnerability

The Answer My Question plugin version 1.3 for WordPress contains an SQL injection vulnerability in the modal.php file. The id POST parameter is directly concatenated into an SQL query without proper sanitization or escaping [1]. Attackers can inject arbitrary SQL statements via the id parameter [2]. The endpoint is accessible to unauthenticated users [2].

Exploitation

An unauthenticated attacker can send a crafted POST request to modal.php with a malicious id value. For example, a proof-of-concept payload uses UNION-based injection to extract data from the wp_terms table [2]. No authentication or special network position is required; the attacker only needs the ability to send HTTP requests to the WordPress instance [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the WordPress database. This can lead to extraction of sensitive information such as terms, configuration data, user credentials, or other stored content [1]. The CVSS v3 score of 8.2 (High) reflects the high confidentiality impact and low integrity impact, with no authentication required [1].

Mitigation

As of the available references, the vulnerability exists in version 1.3 and earlier, and no patched version has been identified. Users are advised to uninstall or disable the plugin until a fix is released [1]. The plugin is no longer maintained on WordPress.org (the last update was in 2014) [2], so users should consider replacing it with an alternative plugin.