CVE-2016-20073

Name of the Vulnerable Software and Affected Versions Answer My Question versions prior to 1.4

Description An SQL injection issue exists due to insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries. Unauthenticated attackers can execute arbitrary SQL queries by injecting malicious code through the id POST parameter at the 'modal.php' endpoint. This allows for the extraction of sensitive database information, such as WordPress terms and configuration data.

Recommendations Update the plugin to a version newer than 1.3. As a temporary mitigation, restrict access to the 'modal.php' endpoint.