CVE-2016-20101: Issuu Panel WordPress Plugin RCE Vulnerability

CVE-2016-20101 Overview

CVE-2016-20101 is a PHP file inclusion vulnerability in the Issuu Panel plugin for WordPress before version 1.6.6. Unauthenticated attackers can abuse the abspath parameter in menu/documento/requests/ajax-docs.php to include remote or local PHP files. Because the parameter flows directly into a require() call, attackers can execute arbitrary PHP code on the target web server. The Shadowserver Foundation first observed exploitation evidence on 2023-10-20, and the issue is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated remote attackers can achieve arbitrary PHP code execution on any WordPress site running Issuu Panel before 1.6.6, leading to full site compromise.

Affected Products

Issuu Panel plugin for WordPress, all versions before 1.6.6
WordPress installations with the Issuu Panel plugin active
Hosting environments permitting PHP allow_url_include for remote file inclusion

Discovery Timeline

2023-10-20 - Shadowserver Foundation observes exploitation evidence in the wild
2026-10-20 - CVE-2016-20101 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2016-20101

Vulnerability Analysis

The vulnerability resides in menu/documento/requests/ajax-docs.php within the Issuu Panel plugin. The script accepts a user-controlled abspath GET parameter and passes it directly into a PHP require() statement without validation or sanitization. This allows attackers to control the path argument of a file inclusion function, which is the defining pattern of CWE-98.

Because the endpoint does not enforce authentication, any remote actor can reach it over HTTP. When allow_url_include is enabled in php.ini, attackers can supply a remote URL and achieve remote file inclusion (RFI) with full PHP code execution. When only allow_url_fopen or local inclusion is available, attackers can still perform local file inclusion (LFI) to disclose sensitive files such as wp-config.php or chain with log poisoning for code execution.

Root Cause

The root cause is unsanitized use of user input in a dynamic file inclusion sink. The plugin trusts the abspath request parameter as a base path and concatenates it into a require() call. No allowlist, path canonicalization, or realpath() boundary check is applied, and no capability or nonce check gates the AJAX endpoint.

Attack Vector

An unauthenticated attacker sends a crafted HTTP GET request to menu/documento/requests/ajax-docs.php with the abspath parameter pointing to an attacker-controlled URL or a sensitive local file. The target WordPress host then includes and executes the referenced PHP content under the web server's user context. No user interaction is required, and the attack is fully remote.

Technical details are described in the VulnCheck advisory and the Nuclei detection template. Historical proof-of-concept material is available via Packet Storm file 136398 and CXSecurity WLB-2016030131.

Detection Methods for CVE-2016-20101

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/issuu-panel/menu/documento/requests/ajax-docs.php carrying an abspath query parameter
abspath values containing http://, https://, ftp://, or php:// schemes, or path traversal sequences like ../../
Unexpected outbound HTTP requests from the web server shortly after inbound hits to the vulnerable endpoint
New or modified PHP files under wp-content/uploads/, backdoors in theme or plugin directories, and anomalous admin account creation

Detection Strategies

Deploy the public Nuclei template for Issuu Panel LFI against internal and external WordPress assets
Alert in the web application firewall (WAF) on any request to ajax-docs.php where abspath contains a URL scheme or ..
Correlate web access logs with EDR process telemetry to identify PHP worker processes spawning shells, curl, wget, or base64 -d
Hunt filesystem events for newly written .php files in upload or plugin directories following inbound hits to the vulnerable path

Monitoring Recommendations

Monitor WordPress plugin inventories for Issuu Panel installations and flag versions below 1.6.6
Track egress connections from web server segments to untrusted hosts, especially to raw IPs or paste sites
Enable file integrity monitoring on wp-content/plugins/, wp-content/themes/, and the WordPress root
Centralize web, PHP-FPM, and auth logs into a SIEM for retrospective hunts across the known exploitation window

How to Mitigate CVE-2016-20101

Immediate Actions Required

Upgrade the Issuu Panel plugin to version 1.6.6 or later, or remove the plugin if it is no longer maintained for your WordPress version
Block all external access to menu/documento/requests/ajax-docs.php at the WAF or reverse proxy layer until patching is confirmed
Set allow_url_include = Off in php.ini to prevent remote file inclusion even if the sink is reachable
Audit the WordPress environment for webshells, unauthorized admin users, and modified core or plugin files

Patch Information

The vulnerability is fixed in Issuu Panel plugin version 1.6.6. Administrators should update via the WordPress plugin dashboard or by replacing the plugin directory with the latest release from the official plugin page. Verify the installed version in wp-content/plugins/issuu-panel/ after upgrade.

Workarounds

Uninstall the Issuu Panel plugin entirely if an upgrade path is not viable
Add a WAF rule that drops requests to ajax-docs.php containing abspath values with URL schemes or traversal sequences
Restrict wp-content/plugins/issuu-panel/menu/documento/requests/ with web server ACLs limiting access to authenticated administrator IP ranges
Harden PHP by disabling allow_url_include and allow_url_fopen where application compatibility permits

bash

# Example Nginx rule blocking exploitation attempts against the vulnerable endpoint
location ~* /wp-content/plugins/issuu-panel/menu/documento/requests/ajax-docs\.php$ {
    if ($arg_abspath ~* "(https?|ftp|php|data|file)://|\.\./") {
        return 403;
    }
    return 403;  # Block entirely until plugin is upgraded to >= 1.6.6
}