CVE-2016-20063: Single Personal Message SQLi Vulnerability

CVE-2016-20063 Overview

CVE-2016-20063 is an SQL injection vulnerability in the Single Personal Message WordPress plugin version 1.0.3. The flaw resides in the plugin's outbox view handler, where the message parameter is concatenated into a database query without proper sanitization. Authenticated users with access to the admin interface can inject arbitrary SQL through this parameter using UNION SELECT payloads. Successful exploitation lets attackers read arbitrary database contents, including WordPress user credentials, password hashes, and site configuration stored in wp_users and wp_options. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can extract WordPress user credentials and arbitrary database content through UNION-based SQL injection in the message parameter of the plugin's outbox view.

Affected Products

Single Personal Message WordPress plugin version 1.0.3
WordPress installations with the simple-personal-message plugin enabled
Sites exposing wp-admin/admin.php?page=simple-personal-message-outbox to authenticated users

Discovery Timeline

2026-06-09 - CVE-2016-20063 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2016-20063

Vulnerability Analysis

The Single Personal Message plugin exposes an admin page that displays sent messages from the outbox. When a user requests wp-admin/admin.php?page=simple-personal-message-outbox&action=view&message=<id>, the plugin passes the message value directly into an SQL query. The plugin does not cast the value to an integer, escape it, or use a prepared statement.

An authenticated attacker supplies a crafted value such as 0 UNION SELECT 1,2,3,name,5,slug,7,8,9,10,11,12 FROM wp_terms WHERE term_id=1. The injected UNION SELECT clause is appended to the original query, and the database returns attacker-controlled columns rendered in the response. By rotating the table referenced in the FROM clause, an attacker can read wp_users.user_login, wp_users.user_pass, wp_options, and any other accessible table.

The affected request observed in the public exploit follows the pattern documented in Exploit-DB #40870 and the VulnCheck Security Advisory.

Root Cause

The root cause is the absence of input validation and parameterized queries on the message GET parameter inside the outbox view handler. The plugin trusts the value as a numeric message identifier but never enforces that constraint. Concatenating user input into SQL is the underlying weakness tracked as [CWE-89].

Attack Vector

The attack vector is network-based and requires an authenticated session with access to the plugin's admin pages. The attacker sends a single crafted HTTP GET request to the WordPress admin endpoint. No user interaction or additional privileges beyond plugin access are required.

The vulnerability is described in prose only; refer to the VulnCheck Security Advisory and Exploit-DB #40870 for the public proof-of-concept request.

Detection Methods for CVE-2016-20063

Indicators of Compromise

HTTP requests to wp-admin/admin.php containing page=simple-personal-message-outbox combined with SQL keywords such as UNION, SELECT, FROM, or INFORMATION_SCHEMA in the message parameter.
URL-encoded SQL syntax (%20UNION%20SELECT, %2CFROM%2C) appearing in webserver access logs against the outbox endpoint.
Unusually long query strings on the simple-personal-message-outbox page or repeated requests with incrementing column counts indicating injection probing.
Database error messages referencing column count mismatches originating from the plugin's outbox query.

Detection Strategies

Enable WordPress debug logging and review queries executed by the simple-personal-message plugin for non-numeric values in the message argument.
Deploy web application firewall rules that block UNION SELECT, information_schema, and stacked SQL tokens against /wp-admin/admin.php query strings.
Hunt in webserver logs for the literal substring simple-personal-message-outbox paired with message= values that are not pure integers.
Correlate authenticated admin sessions that issue outbox view requests with subsequent database read spikes from the WordPress MySQL user.

Monitoring Recommendations

Forward Apache or Nginx access logs and WordPress audit events to a centralized log platform and alert on SQL keywords in plugin URLs.
Monitor for new or unexpected reads against wp_users, wp_usermeta, and wp_options outside of normal WordPress core activity.
Track admin account activity, especially low-privilege users with plugin access, for anomalous request volume against simple-personal-message-outbox.

How to Mitigate CVE-2016-20063

Immediate Actions Required

Deactivate and remove the Single Personal Message plugin if version 1.0.3 is installed and no vendor-supplied patch is available.
Audit wp_users for unrecognized accounts and force a password reset for all WordPress users, given that user_pass hashes may have been exfiltrated.
Rotate WordPress secret keys in wp-config.php (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) to invalidate existing sessions.
Restrict access to /wp-admin/ by IP allowlist or HTTP authentication while remediation is in progress.

Patch Information

No vendor patch is referenced in the available advisory data. The plugin page is listed at WordPress Plugin Information; administrators should verify whether a fixed release exists before reactivating the plugin. If no patched version is published, removal is the recommended path.

Workarounds

Remove the plugin directory wp-content/plugins/simple-personal-message/ from the WordPress installation.
Add a WAF rule that rejects requests to admin.php?page=simple-personal-message-outbox where the message parameter is not a positive integer.
Limit plugin administrative capabilities to a small set of trusted accounts and require multi-factor authentication for WordPress logins.

bash

# Example ModSecurity rule to block non-numeric message IDs on the vulnerable endpoint
SecRule REQUEST_URI "@contains simple-personal-message-outbox" \
    "chain,deny,status:403,id:1602063,msg:'CVE-2016-20063 SQLi attempt'"
    SecRule ARGS:message "!@rx ^[0-9]+$" "t:none"