CVE-2016-20080: WordPress Brandfolder Path Traversal Flaw

CVE-2016-20080 Overview

CVE-2016-20080 is a Local File Inclusion (LFI) vulnerability in the WordPress Brandfolder plugin version 3.0 and earlier. The flaw resides in callback.php, which fails to validate the wp_abspath request parameter before using it in a file inclusion operation. Unauthenticated attackers can supply path traversal sequences or remote URLs through wp_abspath to read sensitive files such as wp-config.php or, when PHP allows remote inclusion, execute attacker-controlled code. The weakness is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated attackers can read wp-config.php to obtain database credentials and WordPress secret keys, leading to full site compromise.

Affected Products

WordPress Brandfolder plugin version 3.0
WordPress Brandfolder plugin versions earlier than 3.0
WordPress sites with callback.php reachable from the Brandfolder plugin directory

Discovery Timeline

2026-06-15 - CVE-2016-20080 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20080

Vulnerability Analysis

The Brandfolder plugin exposes callback.php as a directly reachable PHP endpoint. The script accepts a wp_abspath GET parameter and uses its value to construct the path to WordPress core files included at runtime. No authentication check, allow-list, or path normalization is applied before the include statement executes. An attacker can therefore redirect the include to any file readable by the PHP process or, depending on PHP configuration, to a remote URL.

Exploitation requires only an HTTP request to the vulnerable file, with the wp_abspath value pointing to traversal sequences such as ../../../../etc/passwd or to an attacker-hosted PHP payload when allow_url_include is enabled. Successful reads of wp-config.php expose DB_USER, DB_PASSWORD, and the AUTH_KEY salts, enabling database takeover and session forgery.

Root Cause

The root cause is unsanitized user input flowing directly into a PHP include or require statement. Brandfolder's callback.php trusts the wp_abspath parameter as the WordPress absolute path and concatenates additional path components before inclusion. This pattern is the canonical [CWE-98] anti-pattern: attacker-controlled data influences the filename used by an inclusion directive.

Attack Vector

The attack vector is a single unauthenticated HTTP GET request to wp-content/plugins/brandfolder/callback.php with a crafted wp_abspath parameter. Local file disclosure is achieved with traversal sequences pointing at server files. Remote code execution is achieved by pointing wp_abspath at an attacker-controlled URL serving a PHP payload, when PHP allow_url_include is set to On. Refer to the Exploit-DB entry #39591 and the VulnCheck advisory for verified proof-of-concept details.

Detection Methods for CVE-2016-20080

Indicators of Compromise

HTTP requests to wp-content/plugins/brandfolder/callback.php containing a wp_abspath query parameter
wp_abspath parameter values containing ../ traversal sequences or http://, https://, ftp://, or php:// schemes
Web server access logs showing reads that result in disclosure of wp-config.php content lengths or PHP source files
Outbound HTTP requests from the web server to unfamiliar hosts immediately following requests to callback.php

Detection Strategies

Inspect web server and WAF logs for requests targeting callback.php under the Brandfolder plugin path with any non-empty wp_abspath parameter.
Alert on wp_abspath values that include directory traversal patterns, URL schemes, or null bytes.
Correlate callback.php access events with subsequent file reads of wp-config.php or outbound network connections from PHP-FPM workers.

Monitoring Recommendations

Enable PHP open_basedir logging and monitor for include attempts that fall outside the WordPress installation directory.
Forward Apache or Nginx access logs to a centralized log platform and create rules for the Brandfolder callback.php endpoint.
Track integrity of wp-config.php and WordPress salt rotation events to detect credential exposure aftermath.

How to Mitigate CVE-2016-20080

Immediate Actions Required

Remove or disable the Brandfolder plugin until a fixed version is confirmed installed.
Block external access to wp-content/plugins/brandfolder/callback.php at the web server or WAF layer.
Rotate WordPress database credentials and regenerate the secret keys in wp-config.php, assuming disclosure has occurred.
Audit web server logs for prior exploitation attempts referencing the wp_abspath parameter.

Patch Information

No vendor patch URL is referenced in the NVD record at the time of publication. Administrators should consult the WordPress Plugin Directory listing for Brandfolder for current release status and remove the plugin if version 3.0 or earlier is installed. Additional advisory context is available in the VulnCheck advisory.

Workarounds

Deny HTTP access to callback.php using a web server rule, for example an Nginx location block or Apache <Files> directive.
Set PHP allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent remote file inclusion via URL schemes.
Configure open_basedir to restrict PHP file access to the WordPress installation directory only.
Deploy a WAF rule that blocks requests where wp_abspath contains ../, ://, or null byte sequences.

bash

# Nginx configuration example: deny direct access to the vulnerable callback
location ~* /wp-content/plugins/brandfolder/callback\.php$ {
    deny all;
    return 403;
}

# php.ini hardening to neutralize remote file inclusion
# allow_url_include = Off
# allow_url_fopen = Off
# open_basedir = "/var/www/html:/tmp"