CVE-2016-20082: WordPress Abtest Path Traversal Flaw

CVE-2016-20082 Overview

CVE-2016-20082 is a Local File Inclusion (LFI) vulnerability in the WordPress Abtest plugin. The flaw resides in abtest_admin.php, where the action parameter is used to include files without sufficient validation. Unauthenticated attackers can send crafted GET requests that cause the plugin to include arbitrary files from the admin directory. Successful exploitation allows attackers to execute arbitrary code in the context of the WordPress application. The weakness is classified under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Unauthenticated attackers can include and execute arbitrary PHP files through the vulnerable action parameter in abtest_admin.php, leading to arbitrary code execution on the WordPress host.

Affected Products

WordPress Abtest plugin (all versions distributed via the GitHub ABTest Plugin Repository)
WordPress installations with the Abtest plugin enabled
PHP-based web hosts running affected WordPress deployments

Discovery Timeline

2026-06-15 - CVE-2016-20082 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20082

Vulnerability Analysis

The Abtest plugin exposes abtest_admin.php to handle administrative actions. The script reads the action GET parameter and uses it to construct a file path passed to a PHP include or require statement. Because the parameter is unsanitized, attackers control the file path included at runtime. The endpoint requires no authentication, which extends the attack surface to any remote visitor of the WordPress site. Once an attacker-controlled file is included, the PHP interpreter executes its contents in the plugin's process context.

Root Cause

The root cause is improper control of a filename used in a PHP include directive [CWE-98]. The plugin trusts the action request parameter and concatenates it into an include path without allowlisting valid values or normalizing the path. This pattern allows traversal sequences and references to files outside the intended admin directory.

Attack Vector

An attacker issues a GET request to abtest_admin.php with a malicious action value referencing a chosen file. The plugin resolves that value to a filesystem path and includes the file. If the included file is attacker-controlled or contains PHP code, the server executes it. Public exploit details are available in Exploit-DB #39577 and the VulnCheck WordPress Advisory.

No verified exploit code is reproduced here. Refer to the linked advisories for the proof-of-concept request format and parameter values used during exploitation.

Detection Methods for CVE-2016-20082

Indicators of Compromise

GET requests to abtest_admin.php containing an action parameter with path traversal sequences such as ../ or absolute paths.
Unexpected PHP files written under the plugin's wp-content/plugins/abtest/ directory or the WordPress uploads folder.
Web server access logs showing repeated probes of abtest_admin.php from a single source IP.
Outbound network connections initiated by the PHP worker process to unknown hosts shortly after suspicious requests.

Detection Strategies

Inspect HTTP access logs for the URI pattern abtest_admin.php?action= followed by non-standard values, particularly those containing .., null bytes, or file extensions like .php.
Deploy a Web Application Firewall (WAF) rule that blocks LFI traversal payloads targeting WordPress plugin endpoints.
Apply file integrity monitoring on the WordPress webroot to flag new or modified PHP files under plugin directories.
Correlate web request anomalies with subsequent process executions by PHP-FPM or the web server user.

Monitoring Recommendations

Forward web server, PHP, and WordPress audit logs to a centralized analytics platform for retention and rule-based alerting.
Alert on PHP processes spawning shell utilities such as sh, bash, nc, or curl, which indicate post-exploitation activity following an LFI.
Monitor for new administrative WordPress accounts or unexpected changes to wp-config.php.

How to Mitigate CVE-2016-20082

Immediate Actions Required

Disable and remove the Abtest plugin from all WordPress installations until a vendor patch is confirmed.
Restrict direct access to plugin PHP files via web server configuration so that abtest_admin.php cannot be reached over HTTP.
Review web server logs for prior exploitation attempts referencing abtest_admin.php and contain affected hosts if indicators are found.
Rotate WordPress administrator credentials and secret keys defined in wp-config.php if compromise is suspected.

Patch Information

No official vendor patch is referenced in the available CVE data. The plugin source remains hosted at the GitHub ABTest Plugin Repository, and administrators should consult the VulnCheck WordPress Advisory for the latest remediation guidance. Until a fixed release is published, removal of the plugin is the recommended action.

Workarounds

Block requests to abtest_admin.php at the WAF or reverse proxy layer using a deny rule.
Enforce PHP open_basedir restrictions to limit the directories the WordPress process can include from.
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to reduce the impact of include-based flaws.
Run WordPress under a least-privilege user account so that successful code execution does not yield system-wide access.

bash

# Example nginx rule to deny direct access to the vulnerable endpoint
location ~* /wp-content/plugins/abtest/abtest_admin\.php$ {
    deny all;
    return 403;
}

# Example php.ini hardening
allow_url_include = Off
allow_url_fopen  = Off
open_basedir     = "/var/www/html:/tmp"