CVE-2016-20072 Overview
CVE-2016-20072 is an SQL injection vulnerability in the BBS e-Franchise plugin version 1.1.1 for WordPress. The flaw allows unauthenticated attackers to inject arbitrary SQL through the uid parameter on any page rendering the plugin's shortcode. Attackers can leverage UNION-based payloads to extract sensitive data from the WordPress database, including user account information and taxonomy terms. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). A public exploit exists in Exploit-DB, increasing exposure for sites still running the affected plugin version.
Critical Impact
Unauthenticated remote attackers can extract sensitive WordPress database contents — including user credentials hashes and site metadata — through a single crafted HTTP request.
Affected Products
- BBS e-Franchise WordPress plugin version 1.1.1
- WordPress sites embedding the BBS e-Franchise shortcode with the vulnerable uid parameter
- All downstream WordPress installations distributing the affected plugin release
Discovery Timeline
- 2026-06-15 - CVE-2016-20072 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2016-20072
Vulnerability Analysis
The BBS e-Franchise plugin exposes a shortcode handler that accepts a user-supplied uid parameter and inserts the value directly into a SQL query. Because the plugin neither validates nor parameterizes the input, attackers can append SQL syntax that the underlying MySQL engine interprets as part of the query. UNION-based injection is the documented exploitation path, allowing attackers to graft additional SELECT statements onto the original query and return results from arbitrary tables.
Successful exploitation requires no authentication, no user interaction, and only a network-reachable WordPress page that renders the vulnerable shortcode. The injection runs in the security context of the WordPress database user, which typically has full read access to the wp_users, wp_usermeta, and wp_options tables.
Root Cause
The root cause is unsanitized concatenation of HTTP request input into an SQL statement. The plugin treats the uid parameter as trusted and does not apply WordPress core helpers such as $wpdb->prepare() or esc_sql() before executing the query. This is a textbook CWE-89 defect where developer-supplied query strings mix data and code.
Attack Vector
An attacker issues an HTTP GET or POST request to a page that loads the BBS e-Franchise shortcode and supplies a malicious uid value containing UNION SELECT syntax. The injected payload returns chosen columns from arbitrary tables in the HTTP response body. Refer to the Exploit-DB entry #40782 and the VulnCheck Advisory on SQL Injection for the published proof of concept.
No verified code examples available - see the linked Exploit-DB and VulnCheck advisories for the public proof of concept.
Detection Methods for CVE-2016-20072
Indicators of Compromise
- HTTP requests containing uid= parameters with SQL keywords such as UNION, SELECT, CONCAT, 0x, or -- against pages rendering BBS e-Franchise shortcodes
- WordPress access logs showing unusually long uid query strings or URL-encoded SQL syntax (%20UNION%20SELECT)
- Database error messages or unexpected response bodies returning row data from wp_users or wp_usermeta
- Outbound requests from the web host immediately following suspicious uid query activity, indicating data exfiltration follow-up
Detection Strategies
- Inspect web server and WordPress logs for anomalous uid parameter values and unusually large response sizes on shortcode-bearing URLs
- Deploy a Web Application Firewall (WAF) ruleset that flags UNION-based SQL injection patterns against WordPress endpoints
- Run a plugin inventory across all WordPress sites and identify any installation of BBS e-Franchise version 1.1.1
Monitoring Recommendations
- Monitor MySQL query logs for unexpected UNION SELECT statements originating from the WordPress database user
- Alert on spikes in 200-OK responses paired with abnormally long URLs to public WordPress pages
- Track new administrative user creation, password resets, and option table modifications following injection attempts
How to Mitigate CVE-2016-20072
Immediate Actions Required
- Identify and disable the BBS e-Franchise plugin on any WordPress site still running version 1.1.1
- Remove or replace shortcodes referencing the plugin to eliminate the vulnerable code path
- Rotate WordPress administrator passwords and any secrets stored in the database after confirming exposure
- Audit wp_users and wp_options tables for unauthorized modifications or newly added accounts
Patch Information
No vendor patch is referenced in the available advisory data. The WordPress.org plugin page should be reviewed for any updated release; if no maintained version is available, the plugin should be removed entirely. Consult the VulnCheck Advisory on SQL Injection for current remediation guidance.
Workarounds
- Deploy WAF rules that block requests containing SQL keywords in the uid parameter on affected URLs
- Restrict access to pages embedding the BBS e-Franchise shortcode using authentication or IP allowlists until removal is complete
- Apply least-privilege database credentials so the WordPress database user cannot read unrelated tables or write to system tables
# Example WAF rule (ModSecurity) blocking SQLi patterns in the uid parameter
SecRule ARGS:uid "@rx (?i)(union(\s|/\*.*\*/)+select|select.+from|--|0x[0-9a-f]+)" \
"id:1002016,phase:2,deny,status:403,log,msg:'CVE-2016-20072 BBS e-Franchise SQLi attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
