{"id":"CVE-2016-20101","title":"Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php","summary":"Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/doc…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-98"],"vendor":"Pedro Marcelo","product":"Issuu Panel","affected":["issuu_panel >= 1.0 < 1.6.6"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T20:31:27.518Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2016-20101","references":[{"url":"https://packetstorm.news/files/id/136398/","label":"Packet Storm 136398"},{"url":"https://cxsecurity.com/issue/WLB-2016030131","label":"CXSecurity WLB-2016030131"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/issuu-panel-lfi.yaml","label":"Nuclei Template"},{"url":"https://wordpress.org/plugins/issuu-panel/","label":"WordPress Download Page"},{"url":"https://www.vulncheck.com/advisories/issuu-panel-wordpress-plugin-1.6.6-file-inclusion-via-ajax-docs-php","label":"VulnCheck Advisory: Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T21:19:21.266Z","slug":"CVE-2016-20101","body":"## Overview\n\nIssuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.\n\n## Affected\n\n- `issuu_panel >= 1.0 < 1.6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}