Live › vulnerability › CVE-2016-20101
Go to dashboardThe Issuu Panel plugin for WordPress passes an attacker-supplied 'abspath' parameter to PHP require(), so anyone can load a remote file. That lets an unauthenticated attacker run PHP code on the server or read local files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether the Issuu Panel plugin is installed and its version in wp-content/plugins/ (look for issuu-panel).
Update the Issuu Panel plugin to 1.6.6 or later, or remove it if it is not needed.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
This page as .md · .json · in your agent: get_signal("CVE-2016-20101")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.