Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2016-20101: Issuu Panel WordPress plugin lets attackers load files
CVE-2016-20101 · published 9 days ago
Summary
The Issuu Panel add‑on for WordPress (versions before 1.6.6) can be tricked into loading files it shouldn’t. By sending a specially crafted request, anyone on the internet could cause the site to run code from another location or read sensitive files. Update the plugin to version 1.6.6 or later, or remove it if you don’t need it, to stop this risk.
What to do
- Update pedro marcelo issuu panel to version 1.6.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pedro marcelo | issuu panel | < 1.6.6 |
Original advisory text
Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.2
Critical
Type
CWE-98Improper Control of Filename for Include
Timeline
Published20 Oct 2026
Updated29 Oct 2026
First seen20 Oct 2026
Track software like this
Free during beta