Executive brief
The BBS e-Franchise plugin for WordPress, which is used to manage franchise locations on a website, contains a security flaw that allows unauthorized individuals to access the site's database. By sending a specially crafted web request, an attacker can steal sensitive information such as user details and site configuration data. This could lead to a full compromise of the website's data and user privacy.
Technical details
A UNION-based SQL injection vulnerability exists in the BBS e-Franchise plugin for WordPress (version 1.1.1 and potentially earlier) due to insufficient sanitization of the 'uid' GET parameter. The vulnerability is located in the code handling the plugin's shortcode, where the 'uid' input is directly concatenated into a database query. An unauthenticated remote attacker can exploit this by crafting a malicious URL to extract sensitive information from the WordPress database, including user credentials and taxonomy terms. The plugin has been closed on the WordPress repository and is no longer available for download; users should migrate to a supported alternative.
Affected products
- bbsetheme BBS e-Franchise <= 1.1.1
Timeline
- 2016-11-12: disclosed: Vulnerability discovered and exploit published on Exploit-DB.
- 2025-12-03: other: Plugin closed on WordPress.org due to guideline violations.
- 2026-06-15: advisory: CVE-2016-20072 published.