CVE-2016-20101 in Panel Plugin
Summary
by MITRE • 10/20/2026
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The Issuu Panel plugin for WordPress, prior to version 1.6.6, contains a critical server-side vulnerability classified as Local File Inclusion and Remote Code Execution via Unrestricted File Include. This flaw resides within the ajax-docs.php endpoint located in the menu/documento/requests directory of the plugin's installation path. The root cause is an improper validation mechanism applied to the abspath parameter passed through HTTP GET requests. Instead of sanitizing or restricting this input to a predefined set of allowed files, the application directly passes the user-supplied value into PHP’s require() function without adequate checks for valid file paths or extensions. This architectural oversight allows attackers to manipulate the include path, leading to severe security compromises ranging from data exfiltration to complete server takeover.
From a technical perspective, this vulnerability aligns with CWE-98 Improper Control of Filename for Include/Require Statement in PHP Programs and falls under the broader category of CWE-79 Cross-site Scripting if malicious scripts are included, though its primary impact is code execution. The attacker exploits this by sending crafted GET requests to the specific endpoint while injecting path traversal sequences or absolute paths into the abspath parameter. By leveraging these injection techniques, an unauthenticated actor can force the PHP interpreter to load and execute arbitrary files from the local filesystem or remote servers under their control. This capability effectively bypasses standard authentication mechanisms since no valid user session is required to trigger the inclusion logic, making it a high-severity threat vector for any WordPress site running this specific plugin version.
The operational impact of exploiting this vulnerability is profound. If an attacker includes and executes local files such as wp-config.php or other sensitive configuration files containing database credentials, they can gain unauthorized access to the underlying data store. More critically, by including remote PHP code hosted on a malicious server, attackers achieve Remote Code Execution (RCE). This allows them to run arbitrary commands on the web server with the privileges of the web service user, potentially leading to full system compromise, installation of backdoors, defacement, or use as part of a botnet. The presence of exploitation evidence observed by the Shadowserver Foundation starting October 20, 2023, indicates that this vulnerability is actively being weaponized in the wild against unpatched installations, highlighting an urgent need for remediation across affected infrastructure.
In terms of threat intelligence and behavioral mapping, this attack vector corresponds to MITRE ATT&CK technique T1505.003 Server Software Component: Web Shell, as attackers often use file inclusion to deploy persistent access mechanisms like web shells on the compromised host. It also relates to T1059 Command and Scripting Interpreter for executing arbitrary code once a foothold is established via the included script. Defense strategies must prioritize immediate patching of the Issuu Panel plugin to version 1.6.6 or later, which addresses this input validation flaw. For organizations unable to update immediately due to compatibility constraints, implementing Web Application Firewall rules that block requests containing path traversal characters like ../ in the abspath parameter for the specific ajax-docs.php endpoint provides a temporary mitigation layer. Additionally, restricting PHP’s allow_url_include directive to Off can mitigate remote file inclusion risks, although it does not fully prevent local file inclusion attacks targeting sensitive system files.