{"id":"CVE-2016-20100","kind":"vulnerability","aliases":["CVE-2016-20100"],"related":[],"title":"WordPress Memphis Documents Library: unauthenticated path traversal reads wp-config.php","description":"Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.","summary":"The Memphis Documents Library WordPress plugin before 3.1.6 lets anyone send a GET request with traversal sequences in the mdocs-img-preview parameter to read arbitrary files. Attackers can download wp-config.php and obtain database credentials.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-3.1.6-or-later"],"how_to_check":"Check the installed plugin version in the WordPress admin plugins list or in wp-content/plugins/mdocs-documents-library (readme or main plugin file).","fix":"Update the Memphis Documents Library plugin to 3.1.6 or later; if it cannot be updated, remove it, and rotate database credentials if exposure is suspected.","status":"open","published_at":"2026-10-20T21:17:13+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:37:14+00:00","updated_at":"2026-10-23T22:37:14+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:37:14Z","model":"claude-haiku-5-5","output":{"fix":"Update the Memphis Documents Library plugin to 3.1.6 or later; if it cannot be updated, remove it, and rotate database credentials if exposure is suspected.","reach":"internet","title":"WordPress Memphis Documents Library: unauthenticated path traversal reads wp-config.php","impact":"high","summary":"The Memphis Documents Library WordPress plugin before 3.1.6 lets anyone send a GET request with traversal sequences in the mdocs-img-preview parameter to read arbitrary files. Attackers can download wp-config.php and obtain database credentials.","category":"package","who_cares":["wordpress","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker downloads wp-config.php and gets database credentials","analyst_note":"Confirm the exact fixed version and whether the plugin is still distributed; check the NVD and Shadowserver references for affected version range.","how_to_check":"Check the installed plugin version in the WordPress admin plugins list or in wp-content/plugins/mdocs-documents-library (readme or main plugin file).","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-3.1.6-or-later"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000526,"input_tokens":2973,"output_tokens":457,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-10':116C '-20100':12A,15A '-2016':11A,14A '-22':117C '2023':115C '3.1.6':28B,64C 'allow':71C 'anyon':30B 'arbitrari':47B,76C 'attack':49B,73C,85C 'contain':65C,102C 'credenti':56B,104C 'cve':10A,13A 'databas':55B,103C 'document':3A,23B,58C 'download':51B,100C 'evid':106C 'exploit':105C 'file':48B,77C 'first':108C 'foundat':113C 'get':33B,88C 'host':19B 'img':42B,82C,95C 'let':29B 'librari':4A,24B,59C 'mdoc':41B,81C,94C 'mdocs-downloads.php':98C 'mdocs-img-preview':40B,80C 'memphi':2A,22B,57C 'observ':109C 'obtain':54B 'packag':16B 'paramet':44B,84C 'path':6A,67C 'plugin':26B,60C 'preview':43B,83C,96C 'read':8A,46B,75C 'request':34B,89C 'self':18B 'self-host':17B 'send':31B,87C 'sequenc':37B,92C 'shadowserv':112C 'travers':7A,36B,68C,91C 'unauthent':5A,72C 'via':78C 'vulner':69C 'wordpress':1A,20B,25B,62C 'wp-config.php':9A,52B,101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2016-20100","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20100","severity":null,"published_at":"2026-10-20T21:17:13+00:00","modified_at":"2026-10-23T03:16:30+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}