Path Traversal Vulnerability in Memphis Documents Library Plugin for WordPress
CVE-2016-20100

8.7HIGH

Key Information:

Vendor

WordPress
Status
Memphis Documents Library
Vendor
CVE Published:
20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20100?

The Memphis Documents Library plugin for WordPress prior to version 3.1.6 is susceptible to a path traversal vulnerability. This issue permits unauthenticated attackers to exploit the 'mdocs-img-preview' parameter, enabling them to read arbitrary files on the server. By sending specifically crafted GET requests to the 'mdocs_img_preview()' function in 'mdocs-downloads.php', attackers can access sensitive files, such as 'wp-config.php', potentially exposing database credentials. The exploitation of this vulnerability was first observed by the Shadowserver Foundation on October 22, 2023.

Affected Version(s)

Memphis Documents Library 2.2.1 < 3.1.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20100 - Proof of Concept

CVE-2016-20100 - Proof of Concept

References

https://www.exploit-db.com/exploits/39593
exploit
https://packetstorm.news/files/id/136374/
exploit
https://wpscan.com/vulnerability/53999c06-05ca-44f1-b713-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Felipe Molina
The Shadowserver Foundation
.