CVE-2016-20101

EUVD-2016-10918

20.10.2026, 21:17

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

PHP Remote File Inclusion

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 32.86%

Common Weakness Enumeration

CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

References

https://cxsecurity.com/issue/WLB-2016030131

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/issuu-panel-lfi.yaml

https://packetstorm.news/files/id/136398/

https://wordpress.org/plugins/issuu-panel/

https://www.vulncheck.com/advisories/issuu-panel-wordpress-plugin-1.6.6-file-inclusion-via-ajax-docs-php