CVE-2016-20077: WordPress Photocart Link Path Traversal

CVE-2016-20077 Overview

CVE-2016-20077 is a Local File Inclusion (LFI) vulnerability in the WordPress Photocart Link plugin version 1.6. The flaw resides in the decode.php endpoint, which accepts a base64-encoded file path through the id parameter without sufficient validation. Unauthenticated attackers can submit crafted requests to read arbitrary files from the underlying filesystem. Sensitive targets include wp-config.php, which stores database credentials, authentication keys, and other WordPress configuration data. The issue is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated attackers can retrieve wp-config.php and other sensitive files, exposing database credentials and enabling further site compromise.

Affected Products

WordPress Photocart Link plugin version 1.6
WordPress installations with the vulnerable plugin enabled
Hosting environments serving the plugin's decode.php endpoint

Discovery Timeline

2026-06-15 - CVE-2016-20077 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20077

Vulnerability Analysis

The Photocart Link plugin exposes a decode.php script that accepts a base64-encoded value through the id HTTP parameter. The script decodes this value and uses it to reference a file on disk without normalizing the path or restricting it to an allowed directory. Attackers can encode arbitrary absolute or relative paths and retrieve their contents through the response. This pattern matches the [CWE-98] weakness class, where user-controlled input drives a file inclusion or read operation in a PHP application. The EPSS probability for this CVE is 0.374%, placing it in the 29th percentile of exploitation likelihood.

Root Cause

The root cause is missing input validation and path canonicalization in decode.php. The script trusts the decoded id parameter as a legitimate file reference. No allowlist, basename extraction, or directory restriction is applied before the file is read.

Attack Vector

An attacker crafts a base64 string representing a target file path, such as the encoded form of ../../../wp-config.php. The attacker issues an HTTP request to the plugin's decode.php endpoint with the encoded value supplied in the id parameter. The server decodes the value, reads the referenced file, and returns its contents. No authentication or user interaction is required. Public exploitation details are available in Exploit-DB entry 39623 and the VulnCheck WordPress Advisory.

No verified exploit code is reproduced here. See the linked advisories for technical details.

Detection Methods for CVE-2016-20077

Indicators of Compromise

HTTP requests to /wp-content/plugins/photocart-link/decode.php containing an id query parameter
Base64-encoded values in the id parameter that decode to filesystem paths such as wp-config.php or /etc/passwd
Web server responses returning PHP configuration content or file data outside the plugin directory
Repeated access to decode.php from a single source address within a short time window

Detection Strategies

Inspect web access logs for any requests targeting decode.php in the Photocart Link plugin path
Decode id parameter values and alert when the result contains path traversal sequences or sensitive filenames
Deploy web application firewall rules that block traversal patterns in base64-decoded query strings
Correlate file read events on wp-config.php with HTTP requests to the plugin endpoint

Monitoring Recommendations

Monitor file integrity on WordPress configuration files and alert on unexpected reads by the web server user
Track outbound traffic following requests to decode.php for signs of credential exfiltration
Enable verbose access logging on the plugin directory and retain logs for forensic review

How to Mitigate CVE-2016-20077

Immediate Actions Required

Disable and remove the Photocart Link plugin version 1.6 from all WordPress installations until a patched version is verified
Rotate database credentials, WordPress salts, and API keys stored in wp-config.php if the plugin was exposed to the internet
Restrict direct web access to plugin PHP scripts using web server configuration rules
Audit access logs for prior exploitation attempts against decode.php

Patch Information

No vendor patch is referenced in the available CVE data. Administrators should consult the WordPress Plugin Resource for current plugin status and remove the plugin if no fixed release is published.

Workarounds

Block requests to /wp-content/plugins/photocart-link/decode.php at the web application firewall or reverse proxy
Deny direct PHP execution within the plugin directory through web server configuration
Move wp-config.php one directory above the web root where the WordPress loader still resolves it
Apply least-privilege filesystem permissions so the web server user cannot read files outside the document root

bash

# Example nginx rule to block access to the vulnerable endpoint
location ~* /wp-content/plugins/photocart-link/decode\.php$ {
    deny all;
    return 403;
}