Executive brief
The 404 Redirection Manager plugin for WordPress, which helps manage website traffic by redirecting broken links, contains a security flaw. An unauthorized attacker can use this flaw to access and steal sensitive information from the website's database, such as user credentials or site configuration data. This plugin has been permanently closed by the author and is no longer available for download or updates.
Technical details
An unauthenticated SQL injection vulnerability exists in the 404 Redirection Manager plugin version 1.0 for WordPress. The flaw is located in the 'custom/lib/cf.SR_redirect_manager.class.php' file due to improper sanitization of user input in GET requests. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP GET requests containing SQL injection payloads. Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to the extraction of sensitive data from the WordPress database. The plugin was permanently closed on the WordPress repository in 2021 at the author's request and no official patch is available; users are advised to migrate to a supported alternative.
Affected products
- Fakhri Alsadi 404 Redirection Manager 1.0
Timeline
- 2016-12-17: disclosed: Initial discovery and PoC by Ahmed Sherif (Deloitte)
- 2016-12-19: other: Exploit published on Exploit-DB
- 2021-04-27: other: Plugin permanently closed on WordPress.org at author request
- 2026-06-15: advisory: CVE-2016-20071 published via VulnCheck/NVD