CVE-2016-20079: Dharma Booking Path Traversal Vulnerability

CVE-2016-20079 Overview

CVE-2016-20079 is a Local File Inclusion (LFI) vulnerability affecting the WordPress Dharma Booking plugin versions 2.28.3 and earlier. The flaw resides in proccess.php, where the gateway parameter is passed to a file inclusion routine without proper sanitization. Unauthenticated attackers can supply directory traversal sequences or null byte injection to read arbitrary files on the underlying server. Targets include WordPress configuration files such as wp-config.php, system files like /etc/passwd, and other sensitive resources accessible to the web server process. The weakness is classified as [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated attackers can read arbitrary files on WordPress servers running Dharma Booking 2.28.3 or earlier, exposing database credentials and authentication secrets.

Affected Products

WordPress Dharma Booking plugin version 2.28.3
WordPress Dharma Booking plugin versions prior to 2.28.3
WordPress installations with the Dharma Booking plugin enabled

Discovery Timeline

2026-06-15 - CVE-2016-20079 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20079

Vulnerability Analysis

The Dharma Booking plugin exposes proccess.php to handle payment gateway selection during the booking workflow. The script reads the gateway parameter from the HTTP request and concatenates it into a file path used by a PHP include or require statement. Because the parameter is not validated against an allowlist and traversal sequences are not stripped, an attacker can break out of the intended directory. The inclusion runs in the context of the web server user, granting read access to any file that user can open. Public exploitation details are documented in Exploit-DB #39592 and the VulnCheck Advisory.

Root Cause

The root cause is improper control of a filename used in a PHP include statement [CWE-98]. The gateway parameter flows directly from user input into a dynamic file inclusion without normalization, allowlist validation, or path canonicalization. Older PHP runtimes also honored null byte terminators in file paths, which allowed attackers to truncate appended extensions such as .php.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to proccess.php with a manipulated gateway value. Payloads typically use sequences like ../../../../etc/passwd or ../../../../wp-config.php%00 to traverse out of the plugin directory. The server then includes the targeted file, returning its contents in the HTTP response or rendering them inline. Successful exploitation discloses database credentials, WordPress secret keys, and operating system account data.

No verified code examples are available. Refer to the Exploit-DB entry for the original proof-of-concept request structure.

Detection Methods for CVE-2016-20079

Indicators of Compromise

HTTP requests to proccess.php containing gateway= parameter values with ../, ..\, or URL-encoded equivalents such as %2e%2e%2f.
Requests targeting proccess.php with null byte sequences (%00) appended to the gateway parameter.
Web server access log entries showing repeated proccess.php requests followed by responses leaking file contents such as DB_PASSWORD strings.

Detection Strategies

Inspect web server and WAF logs for traversal patterns directed at /wp-content/plugins/dharma-booking/ endpoints.
Alert on responses from proccess.php containing strings typical of sensitive files (root:x:0:0, define('DB_, AUTH_KEY).
Deploy signatures for [CWE-98] PHP file inclusion patterns within HTTP request inspection rules.

Monitoring Recommendations

Monitor outbound responses from WordPress hosts for unusual file content disclosures correlated with plugin endpoints.
Track file integrity on wp-config.php and authentication-related files for post-exploitation modifications.
Aggregate WordPress plugin request telemetry to detect scanning activity probing legacy or abandoned plugins.

How to Mitigate CVE-2016-20079

Immediate Actions Required

Deactivate and remove the Dharma Booking plugin from any WordPress installation running version 2.28.3 or earlier.
Rotate WordPress salts, database credentials, and any API keys stored in wp-config.php if the plugin was exposed to the internet.
Audit web server logs for prior exploitation attempts against proccess.php.

Patch Information

No vendor patch is referenced in the CVE record. The plugin listing remains available at the WordPress Plugin Directory. Administrators should validate whether a supported successor version exists or migrate to an actively maintained booking plugin.

Workarounds

Block external access to proccess.php at the web server or WAF layer until the plugin is removed or replaced.
Add WAF rules that reject requests containing ../, ..\, or %00 sequences within the gateway parameter.
Restrict PHP open_basedir and disable allow_url_include to limit the scope of any file inclusion attempts.

bash

# Example nginx rule to block traversal attempts against proccess.php
location ~* /wp-content/plugins/dharma-booking/proccess\.php$ {
    if ($arg_gateway ~* "(\.\./|\.\.\\|%00|%2e%2e)") {
        return 403;
    }
}