What’s Vulnerable › Vulnerabilities

CVE-2016-20063: Single Personal Message 1.0.3 WordPress Plugin SQL Injection

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-07-21
• Weakness: CWE-89

Description

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to extract sensitive database information including user credentials and site configuration data.

Affected products

• Md. Shamim Shahnewaz Single Personal Message: 1.0.3

References

• http://lenonleite.com.br/
• http://target/wp-admin/admin.php?page=simple-personal-message-outbox&action=view&message=0%20UNION%20SELECT%201,2.3,name,5,slug,7,8,9,10,11,12%20FROM%20wp_terms%20WHERE%20term_id=1
• https://wordpress.org/plugins/simple-personal-message/
• https://www.exploit-db.com/exploits/40870
• https://www.vulncheck.com/advisories/single-personal-message-wordpress-plugin-sql-injection

Get alerted when CVE-2016-20063 or the next vulnerability affects your stack