{"id":"CVE-2016-20100","title":"Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview","summary":"Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with t…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"Ian Howatson","product":"Memphis Documents Library","affected":["memphis_documents_library >= 2.2.1 < 3.1.6"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T20:31:26.870Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2016-20100","references":[{"url":"https://www.exploit-db.com/exploits/39593","label":"EDB-39593"},{"url":"https://packetstorm.news/files/id/136374/","label":"Packet Storm 136374"},{"url":"https://wpscan.com/vulnerability/53999c06-05ca-44f1-b713-1e4d6b4a3f9f","label":"WPScan Advisory"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-memphis-documents-library-lfi.yaml","label":"Nuclei Template"},{"url":"https://wordpress.org/plugins/memphis-documents-library/","label":"WordPress Download Page"},{"url":"https://www.vulncheck.com/advisories/memphis-documents-library-wordpress-plugin-3.1.6-path-traversal-via-mdocs-img-preview","label":"VulnCheck Advisory: Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T21:19:21.264Z","slug":"CVE-2016-20100","body":"## Overview\n\nMemphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.\n\n## Affected\n\n- `memphis_documents_library >= 2.2.1 < 3.1.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}