PT-2026-49210 · Undefined · Undefined

Published 2026-06-15 · Updated 2026-06-15 · CVE-2016-20072

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-20072

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-20072 · Security Note
• https://exploit-db.com/exploits/40782 · Note
• https://vulncheck.com/advisories/bbs-e-franchise-wordpress-plugin-sql-injection-via-uid · Note
• http://lenonleite.com.br · Note
• https://wordpress.org/plugins/bbs-e-franchise · Note