Junglewise Threat Intelligence

CVE-2016-20063: WordPress Single Personal Message SQL injection in message parameter

CVE-2016-20063 · Severity: high · CVSS 7.1 · Published 2026-06-09

Executive brief

Single Personal Message is a WordPress plugin that allows users to send private messages to one another. A security flaw in version 1.0.3 allows any logged-in user to perform unauthorized database operations. This could lead to the theft of sensitive information, including user credentials and site configuration data, potentially compromising the entire website.

Technical details

An SQL injection vulnerability exists in the Single Personal Message plugin (version 1.0.3) for WordPress due to insufficient sanitization of the 'message' GET parameter in the outbox view component. The vulnerability is located in the admin interface (admin.php) and can be triggered by any authenticated user, including those with low-level 'subscriber' permissions. By supplying crafted SQL statements using UNION SELECT patterns, an attacker can bypass intended access controls to extract sensitive data from the WordPress database, such as the wp_users table. The plugin was closed on the WordPress repository in 2017 and is no longer maintained; users should migrate to a supported alternative.

Affected products

  • Md. Shamim Shahnewaz Single Personal Message 1.0.3

Timeline

  • 2016-11-28: disclosed: Vulnerability discovered and vendor notified by Lenon Leite.
  • 2016-12-05: advisory: Public exploit released on Exploit-DB.
  • 2017-05-15: other: Plugin closed on WordPress.org repository.
  • 2026-06-09: advisory: CVE-2016-20063 published to NVD.

References