CVE-2016-20071: WordPress 404 Redirection Manager SQLi

CVE-2016-20071 Overview

CVE-2016-20071 is an unauthenticated SQL injection vulnerability [CWE-89] in the 404 Redirection Manager plugin version 1.0 for WordPress. The plugin fails to sanitize user-supplied input before incorporating it into database queries. Remote attackers can craft malicious GET requests containing SQL payloads to manipulate backend queries. Successful exploitation enables extraction of sensitive data from the WordPress database, including user credentials and configuration secrets. No authentication is required, which makes the issue trivially reachable on any site running the affected plugin version.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the WordPress database and exfiltrate sensitive data, including administrative credentials.

Affected Products

WordPress 404 Redirection Manager plugin version 1.0
WordPress installations using the vulnerable plugin
Any site exposing the plugin endpoints to the internet

Discovery Timeline

2026-06-15 - CVE-2016-20071 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20071

Vulnerability Analysis

The 404 Redirection Manager plugin accepts user-controlled parameters via HTTP GET requests and concatenates them directly into SQL statements. Because the plugin does not apply parameterized queries or input sanitization, attackers can break out of the intended query context. This allows arbitrary SQL clauses such as UNION SELECT to be appended to the original query. The result is direct read access to any table within the WordPress database, including wp_users and wp_options.

The vulnerability is reachable without authentication, meaning anonymous internet users can trigger it. An exploit entry is published as Exploit-DB #40941, demonstrating practical reachability of the flaw.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin code passes attacker-controlled GET parameters into database query functions without using $wpdb->prepare() or equivalent parameter binding. WordPress provides safe query APIs, but the plugin developer bypassed them, leaving the query string fully attacker-controllable.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker issues a crafted HTTP GET request with a SQL injection payload in a vulnerable parameter handled by the plugin. The backend executes the modified query, returning data or producing observable behavior the attacker can use to extract database contents through union-based or boolean-based techniques. Refer to the Vulncheck Advisory for SQL Injection and Exploit-DB #40941 for technical details on the injection point and payload format.

Detection Methods for CVE-2016-20071

Indicators of Compromise

HTTP GET requests to 404 Redirection Manager plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA.
Web server access logs showing encoded SQL metacharacters (%27, %20OR%20, --) targeting plugin URLs.
Unexpected database query errors in PHP or MySQL logs originating from the plugin's PHP files.
Outbound data transfers correlated with anomalous query response sizes from wp-content/plugins/404-redirection-manager/.

Detection Strategies

Deploy a web application firewall (WAF) rule set that flags SQL injection patterns against WordPress plugin paths.
Enable MySQL general query logging temporarily to identify queries containing union operators or comment sequences originating from plugin code.
Correlate web access logs with database error logs to detect injection attempts that produce malformed queries.
Monitor for sudden spikes in wp_users or wp_options table read activity.

Monitoring Recommendations

Centralize WordPress, PHP, and MySQL logs into a SIEM and alert on SQL injection signatures targeting /wp-content/plugins/404-redirection-manager/.
Track new admin user creation and password hash changes in the wp_users table.
Baseline normal request patterns to the plugin and alert on deviations in parameter content or request volume.

How to Mitigate CVE-2016-20071

Immediate Actions Required

Deactivate and remove the 404 Redirection Manager plugin version 1.0 from all WordPress installations.
Audit wp_users for unauthorized accounts and rotate all WordPress administrator credentials.
Review web server logs for prior exploitation attempts and treat any matches as a potential database compromise.
Rotate WordPress secret keys in wp-config.php and invalidate active sessions.

Patch Information

No vendor-supplied patch is referenced in the available advisory data. The plugin is listed on the WordPress Plugin directory, but no fixed version is identified in the CVE record. Administrators should remove the plugin and select an actively maintained alternative for 404 redirection management.

Workarounds

Block external access to the plugin's PHP endpoints at the web server or WAF layer until removal is complete.
Apply virtual patching rules to drop requests containing SQL metacharacters destined for plugin URLs.
Restrict database user privileges so the WordPress account cannot read sensitive system tables beyond what is required.

bash

# Example nginx rule to block requests to the vulnerable plugin path
location ~* /wp-content/plugins/404-redirection-manager/ {
    return 403;
}