CVE-2016-20071

WordPress 404 Redirection Manager Plugin 1.0 SQL Injection

High8.8Public exploitEPSS 0.30%

Published: 15 Jun 2026
Updated: 28 Jul 2026
Reserved: 15 Jun 2026
Assigned by: VulnCheck

Description

The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-40941 (opens in a new tab)exploit

Timeline

2026
15 Jun 2026
15 Jun 2026
ID reserved
By VulnCheck
15 Jun 2026
15 Jun 2026
Published
28 Jul 202643 days later
28 Jul 2026· 43 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2016-20071, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVDNVD · Deferred	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.30% · top 77% of all CVEs (8 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

404-redirection-manager · 404 Redirection Manager
- affected 1.0

References (3)

ExploitDB-40941 (opens in a new tab)exploit
Product Reference (opens in a new tab)product
VulnCheck Advisory: WordPress 404 Redirection Manager Plugin 1.0 SQL Injection (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2016-20071](https://cveledger.app/badge/CVE-2016-20071.svg)](https://cveledger.app/cve/CVE-2016-20071)

Record last updated 28 Jul 2026, 01:46 UTC.