CVE-2016-20073

HIGH

Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-20073. PoCs published by Lenon Leite.

AI-analyzed exploit summary The exploit demonstrates a SQL injection vulnerability in the 'Answer My Question' WordPress plugin (v1.3) via an unescaped $_POST['id'] parameter. The PoC includes a form that submits a malicious SQL query to extract data from the wp_terms table.

Description

Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Lenon Leite · textwebappsphp
https://www.exploit-db.com/exploits/40771

The exploit demonstrates a SQL injection vulnerability in the 'Answer My Question' WordPress plugin (v1.3) via an unescaped $_POST['id'] parameter. The PoC includes a form that submits a malicious SQL query to extract data from the wp_terms table.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Answer My Question WordPress Plugin v1.3
No auth needed
Prerequisites: Access to the plugin's modal.php endpoint
devstral-2 · analyzed Jun 15, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-40771
https://www.exploit-db.com/exploits/40771
Product product
Official Product Homepage
https://wordpress.org/plugins/answer-my-question/
Product product
Official Product Homepage
http://lenonleite.com.br/
Third Party Advisory third-party-advisory
VulnCheck Advisory: Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php
https://www.vulncheck.com/advisories/answer-my-question-plugin-wordpress-sql-injection-via-modal-php

Scores

CVSS v3 8.2
EPSS 0.0027
EPSS Percentile 18.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
mattkaye/Answer My Question 1.3
Published Jun 15, 2026
Tracked Since Jun 15, 2026