CVE-2016-20073: WordPress Answer My Question SQLi Flaw

CVE-2016-20073 Overview

CVE-2016-20073 is an SQL injection vulnerability in the Answer My Question 1.3 plugin for WordPress. The flaw resides in the modal.php endpoint, which fails to sanitize the id POST parameter before passing it to database queries. Unauthenticated attackers can inject arbitrary SQL statements over the network to extract WordPress terms, configuration data, and other sensitive content from the backend database. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. A public proof-of-concept exists in Exploit-DB entry 40771.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the WordPress database, exposing user data, secrets, and site configuration.

Affected Products

WordPress Answer My Question plugin version 1.3
WordPress installations with the plugin enabled
Sites exposing the plugin's modal.php endpoint to the public internet

Discovery Timeline

2026-06-15 - CVE-2016-20073 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20073

Vulnerability Analysis

The Answer My Question 1.3 plugin exposes a modal.php endpoint that accepts an id parameter via HTTP POST. The plugin concatenates this user-supplied value directly into an SQL query without parameterization or input validation. This concatenation enables classic SQL injection, allowing attackers to alter query logic and append additional statements.

Because the endpoint requires no authentication, exploitation requires only network reachability to a vulnerable WordPress instance. Attackers can use UNION-based or error-based injection techniques to read arbitrary tables, including wp_options and wp_users. Extracted data commonly includes password hashes, session tokens, API keys stored in plugin options, and site secrets.

Root Cause

The root cause is improper neutralization of special elements in an SQL command [CWE-89]. The plugin trusts the id POST parameter and passes it unsanitized into a query string rather than using prepared statements with bound parameters. WordPress provides $wpdb->prepare() for safe parameter binding, but the plugin code bypasses this protection.

Attack Vector

An attacker sends a crafted POST request to the plugin's modal.php script with a malicious payload in the id field. The injected payload modifies the underlying query to return data from arbitrary tables. No user interaction, privileges, or session is required. The vulnerability is network-exploitable and produces high confidentiality impact on the WordPress backend.

The vulnerability is described in prose because no verified exploitation code is included here. Technical details and a working proof-of-concept are available in the Exploit-DB #40771 entry and the VulnCheck Advisory on SQL Injection.

Detection Methods for CVE-2016-20073

Indicators of Compromise

POST requests to /wp-content/plugins/answer-my-question/modal.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the id parameter.
Web server access logs showing repeated modal.php requests from a single source with varying id values.
Unexpected outbound queries against wp_users, wp_options, or wp_usermeta tables in database audit logs.
New or modified administrator accounts following suspicious modal.php traffic.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies sent to modal.php for SQL metacharacters and tautology patterns.
Enable WordPress database query logging and alert on queries originating from the plugin that include UNION SELECT structures.
Correlate HTTP request anomalies with database error responses to identify error-based SQL injection attempts.

Monitoring Recommendations

Monitor for HTTP 500 responses from modal.php, which often indicate broken injection attempts.
Track authentication events for any account whose credentials may have been exposed through option or user table reads.
Audit the wp_options table periodically for tampering with siteurl, home, or active plugin entries.

How to Mitigate CVE-2016-20073

Immediate Actions Required

Deactivate and remove the Answer My Question 1.3 plugin from all WordPress installations until a verified patched version is confirmed.
Block external access to /wp-content/plugins/answer-my-question/modal.php at the WAF or reverse proxy layer.
Rotate WordPress secret keys in wp-config.php and reset administrator passwords if exploitation is suspected.
Review the database for unauthorized accounts, modified options, and injected content.

Patch Information

No vendor patch is referenced in the available advisory data. Consult the WordPress Plugin Info page for current plugin status and the VulnCheck Advisory on SQL Injection for additional remediation guidance. Removing the plugin is the recommended action when a vendor fix is not available.

Workarounds

Restrict access to the plugin directory through .htaccess or NGINX location rules that deny POST requests to modal.php.
Apply virtual patching via WAF signatures that reject requests containing SQL syntax in the id parameter.
Run WordPress behind an authenticating reverse proxy for non-public sites to remove unauthenticated network exposure.

bash

# Apache .htaccess rule to block access to the vulnerable endpoint
<Files "modal.php">
    Require all denied
</Files>

# NGINX equivalent
location ~* /wp-content/plugins/answer-my-question/modal\.php$ {
    deny all;
    return 403;
}