{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aissuuissuu_panelwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:issuu:issuu_panel:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2016-20101"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Issuu Panel (\u003c 1.6.6)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","rce","file-inclusion"],"_cs_type":"advisory","_cs_vendors":["Issuu"],"content_html":"\u003cp\u003eThe Issuu Panel plugin for WordPress, specifically versions prior to 1.6.6, contains a critical vulnerability related to improper input validation in the file 'menu/documento/requests/ajax-docs.php'. The plugin fails to sanitize the 'abspath' parameter before passing it to a PHP 'require()' function. This flaw permits unauthenticated remote attackers to perform Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks. By manipulating the 'abspath' parameter in a crafted GET request, an attacker can force the web server to execute arbitrary PHP code or read sensitive local files from the filesystem. Exploitation of this vulnerability has been observed in the wild since October 2023, necessitating immediate patching for all WordPress instances utilizing this plugin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify WordPress installations running the Issuu Panel plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious GET request targeting the vulnerable file '/menu/documento/requests/ajax-docs.php'.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious file path or remote URL into the 'abspath' parameter of the HTTP request.\u003c/li\u003e\n\u003cli\u003eThe web server process receives the request and processes the PHP file 'ajax-docs.php'.\u003c/li\u003e\n\u003cli\u003eThe vulnerable code within the plugin passes the attacker-supplied 'abspath' value directly to the 'require()' function.\u003c/li\u003e\n\u003cli\u003eThe PHP interpreter executes the code located at the malicious URL or includes the local file specified by the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker gains Remote Code Execution (RCE) on the underlying web server or exfiltrates sensitive server-side files.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary PHP code with the privileges of the web server user (e.g., www-data) or read sensitive configuration files (e.g., wp-config.php), leading to full site compromise, data exfiltration, and potential lateral movement within the hosting environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Issuu Panel plugin for WordPress to version 1.6.6 or later immediately to patch CVE-2016-20101.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous GET requests containing suspicious 'abspath' parameters targeting 'ajax-docs.php'.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect attempts to exploit this file inclusion vulnerability via the web application layer.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:49Z","date_published":"2026-10-20T21:53:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-issuu-panel-rfi/","summary":"The Issuu Panel plugin for WordPress before 1.6.6 is susceptible to unauthenticated remote and local file inclusion via the abspath parameter, enabling arbitrary PHP code execution.","title":"Issuu Panel Plugin: Arbitrary File Inclusion (CVE-2016-20101)","url":"https://feed.craftedsignal.io/briefs/2026-10-issuu-panel-rfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:issuu:issuu_panel:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}