CVE-2016-20101: file inclusion enables RCE

CISO Take

Issuu Panel, a WordPress plugin before 1.6.6, has a PHP file inclusion flaw (CWE-98) in ajax-docs.php. An unauthenticated attacker can pass a crafted 'abspath' value to require() and run remote PHP code or read local files. Despite the 'ml_ui' tag, this is a generic WordPress plugin with no AI/ML-specific component and no tracked AI package affected, so exposure for AI programs is limited to WordPress sites that front or document AI projects. Exploitation evidence was first observed by Shadowserver on 2023-10-20, and a public Nuclei template and Packet Storm entry exist. The CVE is not in CISA KEV and has no EPSS score. Remote file inclusion needs allow_url_include enabled, which is off by default in modern PHP, so the CVSS 8.1 rating reflects high attack complexity. Upgrade to 1.6.6 or later, or remove the plugin if it is unused. Also check web logs for requests to ajax-docs.php with an abspath parameter.

Sources:NVDATLASVulnCheckPacket StormNuclei templates

What is the risk?

Severity is high (CVSS 8.1, network, no privileges, no user interaction, high complexity). Impact on confidentiality, integrity and availability is high. Attackers have exploited it in the wild per Shadowserver (2023), and public PoC material and a scanner template lower the skill needed. Remote inclusion depends on PHP configuration (allow_url_include), while local file inclusion can work more widely. Relevance to AI/ML is low and indirect: the plugin is a document-embedding tool for WordPress, not an AI component. Risk is mostly to the web server and any credentials stored on it.

How does the attack unfold?

Reconnaissance

Attacker scans for WordPress sites exposing the Issuu Panel plugin's ajax-docs.php endpoint.

AML.T0006

Initial Access

Attacker sends an unauthenticated GET request with a crafted abspath value to the vulnerable endpoint.

AML.T0049

Execution

The require() call includes the attacker's remote or local file and runs PHP code on the server.

AML.T0050

Impact

Attacker steals credentials from wp-config.php and any stored API keys, and pivots to connected systems.

Reconnaissance

Attacker scans for WordPress sites exposing the Issuu Panel plugin's ajax-docs.php endpoint.

AML.T0006

Initial Access

Attacker sends an unauthenticated GET request with a crafted abspath value to the vulnerable endpoint.

AML.T0049

Execution

The require() call includes the attacker's remote or local file and runs PHP code on the server.

AML.T0050

Impact

Attacker steals credentials from wp-config.php and any stored API keys, and pivots to connected systems.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Update Issuu Panel to 1.6.6 or later, or remove the plugin; it is old and likely unmaintained. 2) Block direct access to menu/documento/requests/ajax-docs.php at the WAF or web server. 3) Make sure allow_url_include is disabled in php.ini and set open_basedir. 4) Search access logs for GET requests to ajax-docs.php with an abspath parameter, and scan for unexpected PHP files and web shells. 5) If you find signs of compromise, rotate the WordPress salts, database credentials and any API keys stored on the host. 6) Run the public Nuclei template (issuu-panel-lfi) against your own assets to find vulnerable instances.

How is it classified?

Code ExecutionPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and negative impacts

Frequently Asked Questions

What is CVE-2016-20101?

Issuu Panel, a WordPress plugin before 1.6.6, has a PHP file inclusion flaw (CWE-98) in ajax-docs.php. An unauthenticated attacker can pass a crafted 'abspath' value to require() and run remote PHP code or read local files. Despite the 'ml_ui' tag, this is a generic WordPress plugin with no AI/ML-specific component and no tracked AI package affected, so exposure for AI programs is limited to WordPress sites that front or document AI projects. Exploitation evidence was first observed by Shadowserver on 2023-10-20, and a public Nuclei template and Packet Storm entry exist. The CVE is not in CISA KEV and has no EPSS score. Remote file inclusion needs allow_url_include enabled, which is off by default in modern PHP, so the CVSS 8.1 rating reflects high attack complexity. Upgrade to 1.6.6 or later, or remove the plugin if it is unused. Also check web logs for requests to ajax-docs.php with an abspath parameter.

Is CVE-2016-20101 actively exploited?

No confirmed active exploitation of CVE-2016-20101 has been reported, but organizations should still patch proactively.

How to fix CVE-2016-20101?

1) Update Issuu Panel to 1.6.6 or later, or remove the plugin; it is old and likely unmaintained. 2) Block direct access to menu/documento/requests/ajax-docs.php at the WAF or web server. 3) Make sure allow_url_include is disabled in php.ini and set open_basedir. 4) Search access logs for GET requests to ajax-docs.php with an abspath parameter, and scan for unexpected PHP files and web shells. 5) If you find signs of compromise, rotate the WordPress salts, database credentials and any API keys stored on the host. 6) Run the public Nuclei template (issuu-panel-lfi) against your own assets to find vulnerable instances.

What systems are affected by CVE-2016-20101?

This vulnerability affects the following AI/ML architecture patterns: WordPress web front-ends, Web-hosted documentation portals.

What is the CVSS score for CVE-2016-20101?

CVE-2016-20101 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

WordPress web front-endsWeb-hosted documentation portals

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

Exploitation Scenario

An attacker scans for WordPress sites exposing /wp-content/plugins/issuu-panel/menu/documento/requests/ajax-docs.php. They send a GET request with abspath pointing to an attacker-hosted PHP payload, or to a local file to disclose its contents. The server includes the file and runs the payload, giving a web shell. The attacker then reads wp-config.php and any stored credentials, including keys for AI services or cloud accounts used by the organization, and uses them to reach connected systems.

Weaknesses (CWE)

CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Primary CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'): The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.

Source: MITRE CWE corpus.