Unauthenticated SQL Injection in WordPress Redirection Plugin

The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The 404 Redirection Manager plugin for WordPress version 1.0 contains a critical unauthenticated SQL injection vulnerability (CWE-89) that enables remote attackers to execute arbitrary database queries without authentication. This vulnerability is particularly dangerous because it requires no user credentials—any attacker can craft malicious GET requests to exploit unsanitized input handling within the plugin. Organizations running vulnerable versions of this plugin face immediate risk of unauthorized data access, with attackers capable of extracting sensitive information from their WordPress databases including user credentials, customer data, and configuration details. The high CVSS score of 8.2 reflects the combination of network accessibility, lack of authentication requirements, and potential for complete database compromise.

Casky.ai's 754 security skills mapped to MITRE ATT&CK identify this attack pattern through detection of TA0001 (Reconnaissance) and TA0043 (Reconnaissance) techniques, where attackers probe for vulnerable endpoints and craft injection payloads. Using Claude AI's extended reasoning capabilities, practitioners would observe findings related to SQL injection attack patterns: anomalous GET request parameters containing SQL syntax (UNION, SELECT, WHERE clauses), unusual database query execution patterns, and attempts to enumerate database structure. The platform's skill set would flag suspicious input handling in the plugin code and highlight the lack of parameterized queries or input validation—the root causes of this vulnerability. Practitioners using Casky would see correlated alerts indicating exploitation attempts before successful compromise occurs, enabling rapid patching and application hardening before attackers extract sensitive data.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2016-20071.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2016-20071

Casky has 301 skills that investigate the attack patterns behind CVE-2016-20071. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn