PHP File Inclusion Vulnerability in Issuu Panel Plugin for WordPress
CVE-2016-20101

9.2CRITICAL

Key Information:

Vendor

WordPress
Status
Issuu Panel
Vendor
CVE Published:
20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20101?

The Issuu Panel plugin for WordPress prior to version 1.6.6 is vulnerable to PHP file inclusion, allowing unauthenticated attackers to exploit the 'abspath' parameter. By crafting a malicious GET request to menu/documento/requests/ajax-docs.php, attackers can pass harmful values to the require() function to include remote PHP files or local files, thus executing arbitrary code. This vulnerability was flagged by the Shadowserver Foundation with first observed exploitation details reported on October 20, 2023.

Affected Version(s)

Issuu Panel 1.0 < 1.6.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20101 - Proof of Concept

CVE-2016-20101 - Proof of Concept

References

https://packetstorm.news/files/id/136398/
exploit
https://cxsecurity.com/issue/WLB-2016030131
exploit
https://github.com/projectdiscovery/nuclei-templates/blob...
technical-description

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

CrashBandicot
The Shadowserver Foundation
.