CVE-2016-20078: WordPress IMDb Widget Path Traversal Flaw

CVE-2016-20078 Overview

CVE-2016-20078 is a local file inclusion (LFI) vulnerability in the WordPress IMDb Profile Widget plugin version 1.0.8. The flaw resides in the pic.php script, which fails to sanitize the url parameter supplied via GET requests. Unauthenticated attackers can inject directory traversal sequences to read arbitrary files from the underlying web server. Targeted files commonly include wp-config.php, which contains database credentials, authentication keys, and other sensitive configuration data. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated attackers can disclose wp-config.php and other sensitive files, exposing database credentials that enable full WordPress site compromise.

Affected Products

WordPress IMDb Profile Widget plugin version 1.0.8
WordPress installations running the affected plugin
Hosting environments where the plugin is installed and accessible

Discovery Timeline

2026-06-15 - CVE-2016-20078 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20078

Vulnerability Analysis

The WordPress IMDb Profile Widget plugin ships a helper script named pic.php that retrieves image content based on a user-supplied url parameter. The script passes the parameter into a file inclusion or read operation without validating its origin, scheme, or path. Attackers can substitute directory traversal sequences such as ../../../../ to break out of the plugin directory. The server then returns the contents of the requested local file in the HTTP response.

Exploitation requires no authentication, no user interaction, and only standard HTTP access to the affected endpoint. Once wp-config.php is exposed, attackers obtain database credentials, secret keys, and table prefixes. These artifacts allow direct database access, session forgery, and pivoting to administrative WordPress control.

Root Cause

The root cause is missing input validation on the url parameter consumed by pic.php. The plugin treats arbitrary user input as a trusted file path. PHP file functions then resolve the traversal sequences against the local filesystem, returning sensitive content to the attacker.

Attack Vector

An attacker issues a single GET request to the plugin's pic.php endpoint with a crafted url parameter containing relative path traversal payloads. The server reads the targeted file and returns its contents in the HTTP response body. Common targets include wp-config.php, .htaccess, /etc/passwd, and log files containing additional sensitive material.

For verified technical details and proof-of-concept information, refer to the Exploit-DB entry #39621 and the VulnCheck WordPress Advisory.

Detection Methods for CVE-2016-20078

Indicators of Compromise

HTTP GET requests to pic.php containing directory traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f
Web server access logs showing requests to pic.php with url parameter values referencing wp-config.php, /etc/passwd, or other sensitive paths
Unexpected outbound database connections originating from previously unknown IP addresses after suspected credential disclosure
Anomalous administrative logins to WordPress following suspicious pic.php request patterns

Detection Strategies

Inspect web server logs for query strings to pic.php that contain traversal patterns, wp-config, or absolute filesystem paths
Deploy WAF rules that block traversal sequences and known sensitive filenames in plugin endpoints
Audit installed WordPress plugins to identify systems running IMDb Profile Widget version 1.0.8
Monitor file read patterns in PHP-FPM or application logs for access to configuration files from web-facing scripts

Monitoring Recommendations

Forward web server, WAF, and WordPress logs to a centralized analytics platform for correlation
Alert on any HTTP 200 response from pic.php returning content sizes consistent with configuration file disclosure
Track repeated requests from a single source IP to plugin paths over short time windows
Review WordPress administrative actions following any detected LFI attempt to identify possible follow-on compromise

How to Mitigate CVE-2016-20078

Immediate Actions Required

Remove or deactivate the IMDb Profile Widget plugin from all WordPress installations until a patched release is verified
Rotate WordPress database credentials, authentication keys, and salts in wp-config.php if exposure is suspected
Restrict direct access to plugin PHP files at the web server layer using deny rules
Audit administrative user accounts for unauthorized changes or new accounts

Patch Information

No vendor patch has been confirmed in the supplied advisory data. The plugin's status should be verified on the WordPress IMDb Widget Plugin page before reinstallation. Refer to the VulnCheck WordPress Advisory for current remediation status.

Workarounds

Uninstall the affected plugin and replace it with a maintained alternative that performs equivalent functionality
Block requests to pic.php at the web application firewall or reverse proxy layer
Apply web server rules that reject query strings containing ../, ..%2f, or references to wp-config.php
Set restrictive filesystem permissions so the web server user cannot read wp-config.php outside of WordPress core execution

bash

# Example Apache rule to block traversal attempts against pic.php
<Files "pic.php">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f|wp-config) [NC]
    RewriteRule .* - [F,L]
</Files>

# Example Nginx rule
location ~* /imdb-widget/pic\.php$ {
    if ($args ~* "(\.\./|wp-config|/etc/passwd)") {
        return 403;
    }
}