CVE-2016-20064: WP Vault Path Traversal Vulnerability

CVE-2016-20064 Overview

CVE-2016-20064 is a Local File Inclusion (LFI) vulnerability in the WordPress plugin WP Vault version 0.8.6.6. The plugin fails to sanitize the wpv-image GET parameter, allowing unauthenticated attackers to traverse directories and read arbitrary files on the underlying host. Successful exploitation exposes sensitive resources such as /etc/passwd, WordPress configuration files containing database credentials, and other server-side secrets. The flaw is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated attackers can read arbitrary files from the WordPress host, including wp-config.php containing database credentials and authentication keys.

Affected Products

WordPress Plugin: WP Vault version 0.8.6.6
WordPress installations with WP Vault plugin enabled
The plugin page is available at WordPress Plugin: WP Vault

Discovery Timeline

2026-06-09 - CVE-2016-20064 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database
A public exploit is referenced at Exploit-DB #40850
Advisory published at VulnCheck Advisory: WP Vault LFI

Technical Details for CVE-2016-20064

Vulnerability Analysis

WP Vault 0.8.6.6 exposes an include routine that accepts the wpv-image GET parameter without performing path normalization or allowlisting. An attacker appends directory traversal sequences such as ../../../../ to escape the plugin directory and reference files outside the intended scope. Because the parameter feeds a PHP include or require statement, the referenced file is read and rendered in the HTTP response. The request requires no authentication, so any anonymous visitor who can reach the WordPress site can trigger the read primitive.

Root Cause

The root cause is improper control of the filename parameter passed to a PHP file inclusion construct, classified as [CWE-98]. The plugin concatenates user-controlled input directly into the include path without sanitizing traversal characters, validating against an allowlist, or enforcing a base directory. PHP then resolves the relative path and reads any file the web server user can access.

Attack Vector

Exploitation requires only a crafted HTTP GET request to the WordPress endpoint that handles the WP Vault image action. The attacker supplies a payload such as wpv-image=../../../../wp-config.php or wpv-image=../../../../../../etc/passwd. The server returns the file contents in the response body. Reading wp-config.php discloses database credentials, AUTH_KEY, SECURE_AUTH_KEY, and other secrets that enable lateral movement and full site compromise.

No verified proof-of-concept code is reproduced here. Technical details are available in the VulnCheck Advisory: WP Vault LFI and Exploit-DB #40850.

Detection Methods for CVE-2016-20064

Indicators of Compromise

HTTP GET requests containing the wpv-image parameter combined with traversal sequences such as ../, ..%2F, or URL-encoded null bytes
Web server access log entries referencing wp-config.php, /etc/passwd, or /proc/self/environ via the wpv-image parameter
Unexpected outbound activity from the WordPress host shortly after suspicious wpv-image requests, indicating credential reuse

Detection Strategies

Inspect WordPress access logs for any request matching the pattern wpv-image=*../* and treat matches as high-fidelity alerts
Deploy Web Application Firewall (WAF) rules that block traversal characters in query parameters destined for the WP Vault plugin
Hunt for unauthenticated requests to plugin endpoints under /wp-content/plugins/wp-vault/ returning unusually large response bodies

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php and related WordPress secrets to detect read patterns and downstream credential reuse
Forward WordPress and web server logs to a centralized SIEM with parsers that flag LFI signatures in query strings
Alert on database authentication attempts originating from IP addresses that previously issued wpv-image requests with traversal payloads

How to Mitigate CVE-2016-20064

Immediate Actions Required

Disable and remove the WP Vault plugin from any WordPress installation running version 0.8.6.6
Rotate all secrets stored in wp-config.php, including database passwords and the WordPress authentication salts
Audit web server access logs for prior exploitation attempts referencing wpv-image and treat any matches as a confirmed disclosure incident

Patch Information

No vendor patch is referenced in the available advisory data. The plugin should be considered abandoned at version 0.8.6.6. Administrators should remove the plugin entirely and select an actively maintained alternative. Monitor the WordPress Plugin: WP Vault page for any future maintainer updates before reinstalling.

Workarounds

Block all HTTP requests to /wp-content/plugins/wp-vault/ at the WAF or reverse proxy layer until the plugin is removed
Add WAF signatures that reject any request containing wpv-image= followed by traversal sequences such as ../, ..\, or their URL-encoded variants
Restrict file system permissions so the PHP-FPM or web server user cannot read sensitive files outside the WordPress document root

bash

# Example nginx rule to block traversal in the wpv-image parameter
if ($args ~* "wpv-image=[^&]*\.\.") {
    return 403;
}

# Remove the vulnerable plugin directory
wp plugin deactivate wp-vault --allow-root
rm -rf /var/www/html/wp-content/plugins/wp-vault