CVE-2016-20101: Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
WordPress sites using the Issuu Panel plugin in versions before 1.6.6 are exposed. The vulnerable request handler is menu/documento/requests/ajax-docs.php.
Does exploitation require authentication or user interaction?
No. An attacker can send a crafted GET request without authenticating or requiring any action from a site user.
What capability does an attacker need to exploit the issue?
The attacker needs network access to the vulnerable endpoint and must craft the abspath parameter supplied to require(). The vulnerability can be used to include local files or, where remote inclusion is possible, execute remote PHP code.
How can I identify possible exploitation attempts?
Review web-server and application logs for GET requests to menu/documento/requests/ajax-docs.php, particularly requests containing an abspath parameter with local-file paths or remote URLs. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.