CVE-2016-20081: HB Audio Gallery Lite Path Traversal

CVE-2016-20081 Overview

CVE-2016-20081 is a path traversal vulnerability [CWE-22] in the WordPress plugin HB Audio Gallery Lite version 1.0.0. The plugin exposes an audio-download.php endpoint that accepts a file_path parameter without proper sanitization. Unauthenticated remote attackers can supply directory traversal sequences to read arbitrary files outside the gallery directory, including sensitive WordPress files such as wp-config.php. The disclosure of wp-config.php exposes database credentials, authentication keys, and salts, which enables follow-on compromise of the WordPress installation.

Critical Impact
Unauthenticated attackers can download arbitrary files from the web server, including wp-config.php, leading to full database credential exposure and potential site takeover.

Affected Products

WordPress Plugin HB Audio Gallery Lite 1.0.0
WordPress installations with the vulnerable plugin enabled
Any hosting environment running the unpatched plugin version

Discovery Timeline

2026-06-15 - CVE-2016-20081 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20081

Vulnerability Analysis

The HB Audio Gallery Lite plugin ships a download handler at audio-download.php intended to serve audio files from a defined gallery directory. The handler reads the file_path request parameter and passes it directly to file read or download logic without canonicalization or restriction to the intended base directory. This omission permits classic directory traversal using ../ sequences to escape the gallery folder and access any file readable by the PHP process.

The issue is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Because the endpoint requires no authentication, exploitation can be performed by any remote actor able to send an HTTP request to the WordPress site. Successful exploitation yields confidentiality impact through file disclosure. There is no direct integrity or availability impact from the vulnerability itself, though disclosed secrets typically enable follow-on attacks.

Root Cause

The root cause is missing input validation on the file_path parameter. The plugin does not enforce a whitelist of permitted files, does not resolve the canonical path before serving content, and does not verify the resolved path remains within the gallery directory. Traversal sequences are preserved when the file is opened by the PHP runtime.

Attack Vector

Attackers send a crafted HTTP GET request to the audio-download.php endpoint with a file_path value containing ../ sequences targeting files outside the gallery directory. A typical payload targets wp-config.php by traversing up the directory tree from the plugin folder to the WordPress root. The response delivers the file contents to the attacker. Publicly available exploit details are referenced in Exploit-DB #39589 and the VulnCheck Security Advisory.

No verified proof-of-concept code is reproduced here. See the referenced advisories for full technical details of the request structure.

Detection Methods for CVE-2016-20081

Indicators of Compromise

HTTP requests to audio-download.php containing ../ or URL-encoded %2e%2e%2f traversal sequences in the file_path parameter
Requests to audio-download.php with file_path values referencing sensitive filenames such as wp-config.php, .htaccess, or /etc/passwd
Web server access logs showing successful 200 responses to suspicious audio-download.php requests from unauthenticated sources
Unexpected outbound transfer of configuration files originating from the WordPress webroot

Detection Strategies

Inspect web server and WordPress access logs for requests matching the path /wp-content/plugins/hb-audio-gallery-lite/audio-download.php with traversal patterns in the query string
Deploy Web Application Firewall (WAF) rules that block path traversal payloads on plugin endpoints
Monitor for repeated requests to the audio download endpoint from a single IP within short time windows, indicating enumeration

Monitoring Recommendations

Forward Apache, Nginx, or PHP-FPM access logs to a centralized log analytics platform for correlation and alerting
Alert on any access to wp-config.php content patterns appearing in HTTP response bodies
Track installation inventory of WordPress plugins across the environment to identify hosts running HB Audio Gallery Lite 1.0.0

How to Mitigate CVE-2016-20081

Immediate Actions Required

Deactivate and remove the HB Audio Gallery Lite plugin from all WordPress installations until a patched version is confirmed
Rotate WordPress database credentials, authentication keys, and salts in wp-config.php if the plugin was exposed to the internet
Audit the WordPress site for unauthorized administrative accounts, modified files, and injected content
Restrict access to the WordPress admin interface and plugin endpoints by IP allowlist where feasible

Patch Information

No vendor-supplied patch is referenced in the available advisories. The plugin page should be consulted for current maintenance status. If no updated version is available, removal of the plugin is the recommended path. Review the VulnCheck Security Advisory for additional remediation guidance.

Workarounds

Block HTTP requests to /wp-content/plugins/hb-audio-gallery-lite/audio-download.php at the web server or WAF layer
Add WAF signatures that reject query strings containing ../, ..\, or URL-encoded traversal sequences targeting plugin endpoints
Set restrictive filesystem permissions on wp-config.php so it is readable only by the web server user, and consider relocating it above the webroot
Enable PHP open_basedir restrictions to confine file read operations to the WordPress installation directory

bash

# Example Nginx rule to block traversal attempts against the vulnerable endpoint
location ~* /wp-content/plugins/hb-audio-gallery-lite/audio-download\.php {
    if ($args ~* "\.\./|%2e%2e%2f|%2e%2e/") {
        return 403;
    }
    # Optional: block the endpoint entirely until the plugin is removed
    return 403;
}