Live › vulnerability › CVE-2016-20100
Go to dashboardThe Memphis Documents Library WordPress plugin before 3.1.6 lets anyone send a GET request with traversal sequences in the mdocs-img-preview parameter to read arbitrary files. Attackers can download wp-config.php and obtain database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed plugin version in the WordPress admin plugins list or in wp-content/plugins/mdocs-documents-library (readme or main plugin file).
Update the Memphis Documents Library plugin to 3.1.6 or later; if it cannot be updated, remove it, and rotate database credentials if exposure is suspected.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
This page as .md · .json · in your agent: get_signal("CVE-2016-20100")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.