CVE-2016-20101

Received Received - Intake

PHP File Inclusion in Issuu Panel WordPress Plugin

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2016-20101

Affected Vendors & Products

Vendor	Product	Version / Range
Pedro	Marcelo	Issuu Panel 1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

This vulnerability is a PHP file inclusion issue in the Issuu Panel plugin for WordPress versions before 1.6.6. It allows unauthenticated attackers to include remote or local files by exploiting the 'abspath' parameter in a GET request to menu/documento/requests/ajax-docs.php. The vulnerability arises because the plugin passes the 'abspath' value directly to a require() function without proper validation.

Detection Guidance

Check for requests to menu/documento/requests/ajax-docs.php with the abspath parameter in web server logs. Look for unusual file inclusion attempts or remote file references in PHP execution traces.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary PHP code on your server or include sensitive local files. This could lead to complete system compromise, data theft, or unauthorized access to your WordPress site and underlying server. Attackers could potentially take control of your website, deface it, or use it as a launchpad for further attacks.

Compliance Impact

This vulnerability could lead to data breaches, which would violate GDPR and HIPAA requirements for data protection and security. If exploited, it may result in unauthorized access to personal or sensitive health data, leading to legal penalties, fines, and reputational damage for organizations handling such data.

Mitigation Strategies

Update the Issuu Panel plugin to version 1.6.6 or later. If an update is unavailable, disable or remove the plugin immediately. Restrict access to the ajax-docs.php file via server configuration.

Hi! I’m here to help you understand CVE-2016-20101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70