{"id":"CVE-2016-20101","kind":"vulnerability","aliases":["CVE-2016-20101"],"related":[],"title":"WordPress Issuu Panel plugin: unauthenticated file inclusion runs remote PHP code","description":"Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","summary":"The Issuu Panel plugin for WordPress passes an attacker-supplied 'abspath' parameter to PHP require(), so anyone can load a remote file. That lets an unauthenticated attacker run PHP code on the server or read local files.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["issuu-panel","package","self-hosted","wordpress"],"not_affected_if":["managed-hosting","plugin-not-installed"],"how_to_check":"Check whether the Issuu Panel plugin is installed and its version in wp-content/plugins/ (look for issuu-panel).","fix":"Update the Issuu Panel plugin to 1.6.6 or later, or remove it if it is not needed.","status":"open","published_at":"2026-10-20T21:17:13+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:20+00:00","updated_at":"2026-10-23T22:39:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:20Z","model":"claude-haiku-5-5","output":{"fix":"Update the Issuu Panel plugin to 1.6.6 or later, or remove it if it is not needed.\nunknown","reach":"internet","title":"WordPress Issuu Panel plugin: unauthenticated file inclusion runs remote PHP code","impact":"high","summary":"The Issuu Panel plugin for WordPress passes an attacker-supplied 'abspath' parameter to PHP require(), so anyone can load a remote file. That lets an unauthenticated attacker run PHP code on the server or read local files.","category":"package","who_cares":["wordpress","self-hosted","issuu-panel"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs PHP code on the server and reads secrets","analyst_note":"Confirm the exact fixed version and whether the file menu/documento/requests/ajax-docs.php exists in the plugin via the NVD link or the plugin's changelog.","how_to_check":"Check whether the Issuu Panel plugin is installed and its version in wp-content/plugins/ (look for issuu-panel).\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","plugin-not-installed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000523,"input_tokens":2994,"output_tokens":447,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10':126C '-20':127C '-20101':14A,17A '-2016':13A,16A '1.6.6':70C '2023':125C 'abspath':37B,89C,101C 'allow':78C 'anyon':43B 'attack':35B,53B,80C,91C 'attacker-suppli':34B 'code':11A,56B,110C 'contain':71C 'craft':100C 'cve':12A,15A 'evid':116C 'execut':107C 'exploit':115C 'file':6A,48B,63B,74C,86C,114C 'first':118C 'foundat':123C 'get':94C 'host':24B 'includ':82C,112C 'inclus':7A,75C 'issuu':2A,19B,27B,64C 'issuu-panel':18B 'let':50B 'load':45B 'local':62B,85C,113C 'menu/documento/requests/ajax-docs.php':97C 'observ':119C 'packag':21B 'panel':3A,20B,28B,65C 'paramet':38B,90C 'pass':32B,103C 'php':10A,40B,55B,73C,109C 'plugin':4A,29B,66C 'read':61B 'remot':9A,47B,83C,108C 'request':95C 'requir':41B,105C 'run':8A,54B 'self':23B 'self-host':22B 'send':93C 'server':59B 'shadowserv':122C 'suppli':36B 'unauthent':5A,52B,79C 'valu':102C 'vulner':76C 'wordpress':1A,25B,31B,68C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2016-20101","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20101","severity":null,"published_at":"2026-10-20T21:17:13+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}