CVE-2016-20077 in Photocart Link
Summary
by MITRE • 06/15/2026
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/18/2026
The WordPress Photocart Link plugin version 1.6 contains a critical local file inclusion vulnerability that represents a significant security risk for affected installations. This vulnerability exists within the decode.php endpoint and stems from inadequate input validation mechanisms that fail to properly sanitize user-supplied data. The flaw allows unauthenticated attackers to exploit the application by manipulating the 'id' parameter with base64-encoded file paths, effectively bypassing normal file access controls and enabling arbitrary file retrieval from the server filesystem. This vulnerability directly maps to CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The security implications extend beyond simple file disclosure, as attackers can access sensitive configuration files such as wp-config.php that contain database credentials, cryptographic keys, and other critical system information. Such exposure creates a pathway for further exploitation including potential database compromise, privilege escalation, and complete system takeover. The vulnerability operates at the application layer and can be exploited through simple http requests without requiring authentication or prior access to the system. This makes it particularly dangerous as it can be discovered and exploited by automated scanning tools, leading to widespread compromise of vulnerable WordPress installations. The attack vector specifically targets the decode.php script which processes user input without adequate sanitization, allowing base64-encoded malicious paths to be decoded and executed within the file system context. This weakness aligns with ATT&CK technique T1213.002 which covers data from local system, and represents a clear violation of the principle of least privilege as the application grants unrestricted file access through a single parameter. The operational impact includes potential exposure of sensitive credentials, application source code disclosure, and compromise of user data stored in the database. Organizations running affected versions should immediately implement mitigations including input validation, parameter sanitization, and access control restrictions. The vulnerability demonstrates the critical importance of proper input validation and the potential consequences of insufficient security controls in web applications. Patching the plugin to a secure version or implementing web application firewalls to block malicious requests represents the most effective remediation strategies. Additionally, regular security audits and vulnerability assessments should be conducted to identify similar flaws in other components of the web application stack. The presence of such vulnerabilities highlights the need for robust security practices including secure coding standards, regular updates, and comprehensive security testing throughout the software development lifecycle.